Description
FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.
Published: 2026-10-26
Score: 8.5 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.
Title FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow
First Time appeared Fltk Project
Fltk Project fltk
Weaknesses CWE-190
CPEs cpe:2.3:a:fltk_project:fltk:*:*:*:*:*:*:*:*
Vendors & Products Fltk Project
Fltk Project fltk
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Fltk Project Fltk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T21:52:28.153Z

Reserved: 2026-10-26T20:23:34.151Z

Link: CVE-2026-116724

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T22:16:56.070

Modified: 2026-10-26T22:16:56.070

Link: CVE-2026-116724

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T06:45:06Z

Weaknesses