AZL-111106: CVE-2026-116723 affecting package fltk 1.3.8-1

Q: What input must an attacker control to trigger this issue?

An attacker must be able to supply a crafted BMP or ICO file that FLTK processes. The file needs an oversized colors_used field, above 256, to overflow the fixed 768-byte colormap array.

Q: What are the likely consequences of successful exploitation?

Processing the crafted image can corrupt stack memory. This may cause an application crash and could potentially enable code execution.

Q: Which FLTK versions are within the stated affected range?

The issue is reported in FLTK through version 1.4.5. The affected Azure Linux package identified here is fltk 1.3.8-1.

Published Oct 26, 2026

Updated

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in FlBMPImage::loadbmp() that allows attackers to corrupt stack memory by supplying an oversized BMP colorsused field. Attackers can craft BMP or ICO files with colorsused above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.

Affected Software

1 affected component

azure-linux/fltk<=1.3.8-1

Event History

Oct 26, 2026

Advisory Published

via OSV·10:16 PM

Data Sourced

via OSV·10:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116723

Frequently Asked Questions

What input must an attacker control to trigger this issue?

An attacker must be able to supply a crafted BMP or ICO file that FLTK processes. The file needs an oversized colors_used field, above 256, to overflow the fixed 768-byte colormap array.

What are the likely consequences of successful exploitation?

Processing the crafted image can corrupt stack memory. This may cause an application crash and could potentially enable code execution.

Which FLTK versions are within the stated affected range?

The issue is reported in FLTK through version 1.4.5. The affected Azure Linux package identified here is fltk 1.3.8-1.

AZL-111106: CVE-2026-116723 affecting package fltk 1.3.8-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What input must an attacker control to trigger this issue?

What are the likely consequences of successful exploitation?

Which FLTK versions are within the stated affected range?

Company

Resources

Contact

Frequently Asked Questions

What input must an attacker control to trigger this issue?

What are the likely consequences of successful exploitation?

Which FLTK versions are within the stated affected range?