CVE-2026-47667 in CImg
Summary
by MITRE • 07/21/2026
CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability resides in the CImg Library's handling of Analyze/NIfTI image files through the `_load_analyze()` function, which processes header information from binary image files. This flaw represents a classic buffer allocation vulnerability that can lead to memory exhaustion and resource exhaustion attacks. The library reads the header_size field as an unsigned 32-bit integer from the first four bytes of Analyze/NIfTI files, directly using this value to allocate memory without any bounds checking against the actual file size. This design pattern violates fundamental security principles of input validation and memory management, creating a potential denial of service condition where maliciously crafted files can trigger excessive memory allocations.
The technical implementation of this vulnerability stems from the improper handling of file parsing operations within the image loading pipeline. When the `load_analyze()` function encounters a malformed file, it attempts to read header_size bytes into a buffer allocated with `new unsigned char[header_size]`. However, when the subsequent `fread` operation returns a short value indicating fewer bytes were read than expected, the function throws a `CImgIOException` exception. The critical flaw occurs because the allocated memory buffer is never freed during error handling paths, creating a memory leak that accumulates with each failed file parsing attempt. This behavior represents a memory management issue classified under CWE-401, specifically related to improper deallocation of memory resources.
The operational impact of this vulnerability extends beyond simple denial of service to potentially enable more sophisticated attack vectors. An attacker can craft a 6-byte malicious file that triggers allocation of approximately 1.3 gigabytes of memory per function call, with each error path leaking the allocated buffer without proper cleanup. This pattern allows for rapid exhaustion of system memory resources, particularly concerning when the library is used in applications processing untrusted image files such as web applications or batch processing systems. The vulnerability affects multiple file extensions including .hdr, .img, and .nii, making it broadly applicable across different image processing scenarios that utilize the Analyze/NIfTI format standard.
The exploitability of this vulnerability aligns with ATT&CK technique T1499.004 for resource exhaustion attacks, where adversaries target memory allocation functions to consume system resources. The vulnerability demonstrates a clear path from file input manipulation to system instability through improper bounds checking and exception handling patterns. Modern security frameworks would classify this issue as a high-risk vulnerability due to its potential for causing system-wide memory exhaustion, particularly in environments with limited memory resources or when the vulnerable library is used in server applications processing multiple concurrent requests.
Mitigation strategies should focus on implementing proper input validation before memory allocation operations, establishing bounds checking against actual file sizes, and ensuring all allocated resources are properly freed even during error conditions. The fix implemented in version 4.0.0 addresses these concerns by adding appropriate size validation checks that prevent excessive memory allocations while maintaining backward compatibility with legitimate image files. System administrators should prioritize updating to the patched version and consider implementing additional monitoring for memory allocation patterns in applications using the CImg Library. Security teams should also review other similar libraries for analogous vulnerabilities in file parsing and memory management operations to prevent cascading issues across dependent systems.