CVE-2026-42144
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In CImg Library (a C++ image processing library) prior to commit 4ca26bc, an integer overflow in the W*H*D size computation inside _load_pnm() can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow.
Risk Assessment
Any application using CImg to load untrusted images may crash or be exposed to a heap buffer overflow, potentially leading to code execution. The risk applies to processing user-supplied files.
Recommendation
Update CImg to a version containing commit 4ca26bc. Until then, avoid loading untrusted PNM/PGM/PPM files.
Other vulnerabilities in CImg Library
See all- CVE-2026-47667High
Vulnerability in CImg Library before version 4.0.0. The `_load_analyze()` function reads the `header_size` field from an Analyze/NIfTI file and allocates memory without checking the file size, potentially causing memory leaks (e.g., 1.3 GB per call) with a crafted 6-byte file.
- CVE-2026-42146Medium
In CImg Library prior to commit c3aacf5, the nb_colors field read from the BMP file header is used directly to compute an allocation size without validating it against the remaining file size. A crafted BMP file with a large nb_colors value triggers an out-of-memory condition, crashing any application that uses CImg to load untrusted BMP files.
Original NVD description (English source)
CImg Library is a C++ library for image processing. Prior to commit 4ca26bc, there is an integer overflow vulnerability in the W*H*D size computation inside _load_pnm() that can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow. Any application using CImg to load untrusted image files is affected. This issue has been patched via commit 4ca26bc.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS