CVE-2026-116724

HighCVSS 7.8

Published: 26/10/2026(UTC)Updated: 31/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.

Risk Assessment

Opening a crafted image file can corrupt the application heap, leading to a crash or potential code execution. The risk affects applications using FLTK to process BMP/ICO images from untrusted sources.

Recommendation

Upgrade FLTK to a version newer than 1.4.5 if available, or restrict processing of untrusted BMP/ICO files. Where possible, validate image dimensions before loading.

Other vulnerabilities in FLTK

CVE-2026-116723High
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS