---
id: "CVE-2026-117555"
kind: "vulnerability"
aliases: ["CVE-2026-117555"]
title: "CImg: crafted BMP file triggers heap out-of-bounds read in image loader"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "cimg", "image-processing", "package"]
not_affected_if: ["bmp-loader-unused", "no-untrusted-bmp-input"]
published_at: "2026-10-27T14:16:36+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:33:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117555", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# CImg: crafted BMP file triggers heap out-of-bounds read in image loader

CImg, a C++ image-processing header library, has an integer overflow in its BMP loader (_load_bmp in CImg.h) that wraps the row byte count. A crafted BMP with a large width can make the loader read past a heap buffer, crashing the program or leaking heap memory into the decoded image.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project includes CImg.h, for example with `grep -rn "CImg.h" .` or in the build's include paths.
- Check the CImg version in use; the sources say versions through `4.0.6` are affected.
- Check whether the code loads BMP files from untrusted sources with `CImg<T>::load` or `load_bmp`.

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117555

## From the sources

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_