CVE-2026-117555 in CImg
Summary
by MITRE • 10/27/2026
CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The Common Vulnerabilities and Exposures identifier for this issue highlights a critical flaw within the CImg library, specifically affecting versions up to 4.0.6. This vulnerability resides in the _load_bmp() function located in the CImg.h header file, which is responsible for parsing Bitmap image files. The core technical defect stems from an integer overflow that occurs during the calculation of row byte counts. When processing a BMP file with specific structural characteristics, particularly those involving large width values defined in the file header, the arithmetic operation used to determine the number of bytes per row fails to account for boundary conditions properly. This miscalculation results in dx_bytes wrapping around due to integer overflow, leading to an incorrect allocation or access size that is significantly smaller than what should be required for safe memory operations.
This mathematical error directly facilitates a heap out-of-bounds read vulnerability. Because the calculated row byte count is erroneously small, subsequent memory access patterns may attempt to read data beyond the allocated buffer boundaries when processing image rows. An attacker can exploit this by crafting a malicious BMP file that contains an intentionally large header width value designed to trigger the integer overflow condition. Upon loading such a crafted file into an application utilizing the vulnerable version of CImg, the library will perform memory reads outside the intended heap region. This behavior violates standard memory safety principles and aligns with CWE-125, which describes out-of-bounds read vulnerabilities where software accesses memory beyond the end or before the beginning of the intended buffer.
The operational impact of this vulnerability is severe, primarily manifesting as application crashes due to segmentation faults when the operating system detects illegal memory access attempts. However, more critically, it enables heap memory disclosure attacks. By carefully controlling the input and analyzing subsequent program behavior or output data, an attacker can potentially read sensitive information stored in adjacent heap regions that were not intended for exposure. This could include stack pointers, other object addresses, or even secret keys if they reside nearby in memory. Such information leakage aids further exploitation efforts by allowing attackers to bypass security mechanisms like Address Space Layout Randomization (ASLR). From a threat modeling perspective, this vulnerability is often associated with the ATT&CK technique of T1083, which covers file and directory discovery, although here it serves as an initial vector for memory corruption or data exfiltration rather than simple enumeration.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The most effective solution is to upgrade the CImg library to a version greater than 4.0.6 where this integer overflow has been patched with proper bounds checking and arithmetic validation before memory allocation or access occurs. For applications that cannot immediately update their dependencies, implementing input sanitization at the point of file ingestion can provide some protection by validating BMP header fields against expected maximum dimensions before passing them to the image processing functions. Additionally, developers should employ static analysis tools configured to detect integer overflow patterns in arithmetic operations involving buffer sizes. Enabling compiler flags such as -fstack-protector and using Address Sanitizer during development phases can help identify similar logical errors early in the software lifecycle. Ultimately, ensuring that all external inputs are validated for range constraints before being used in memory management calculations is essential to preventing this class of vulnerabilities across image processing libraries.