CVE-2026-42146
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In CImg Library prior to commit c3aacf5, the nb_colors field read from the BMP file header is used directly to compute an allocation size without validating it against the remaining file size. A crafted BMP file with a large nb_colors value triggers an out-of-memory condition, crashing any application that uses CImg to load untrusted BMP files.
Risk Assessment
An application using CImg to load untrusted BMP files may crash due to memory exhaustion (DoS). This may disrupt the availability of an image-processing service.
Recommendation
Update CImg to a version containing commit c3aacf5. Until then, avoid loading untrusted BMP files.
Other vulnerabilities in CImg Library
See all- CVE-2026-47667High
Vulnerability in CImg Library before version 4.0.0. The `_load_analyze()` function reads the `header_size` field from an Analyze/NIfTI file and allocates memory without checking the file size, potentially causing memory leaks (e.g., 1.3 GB per call) with a crafted 6-byte file.
- CVE-2026-42144Medium
In CImg Library (a C++ image processing library) prior to commit 4ca26bc, an integer overflow in the W*H*D size computation inside _load_pnm() can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow.
Original NVD description (English source)
CImg Library is a C++ library for image processing. Prior to commit c3aacf5, the nb_colors field read from the BMP file header is used directly to compute an allocation size without validating it against the remaining file size. A crafted BMP file with a large nb_colors value triggers an out-of-memory condition, crashing any application that uses CImg to load untrusted BMP files. This issue has been patched via commit c3aacf5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS