CVE-2026-116723
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Risk Assessment
A crafted image file can crash the application or potentially execute code in its context. The risk affects applications using FLTK to load BMP/ICO images from untrusted sources.
Recommendation
Upgrade FLTK to a version newer than 1.4.5 if available, or restrict processing of untrusted BMP/ICO files. Consider validating the colors_used field before decoding an image.
Other vulnerabilities in FLTK
Original NVD description (English source)
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS