AZL-111109: CVE-2026-116724 affecting package fltk 1.3.8-1

Q: Which deployments are in scope?

The issue affects FLTK through version 1.4.5. The identified Azure Linux package is fltk 1.3.8-1.

Q: What must an attacker be able to do to trigger the flaw?

An attacker needs to provide a crafted BMP or ICO file that the application processes. The file uses large, attacker-controlled dimensions to cause an undersized pixel-buffer allocation and subsequent heap corruption.

Published Oct 26, 2026

Updated

FLTK through 1.4.5 contains an integer overflow vulnerability in FlBMPImage::loadbmp() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.

Affected Software

1 affected component

azure-linux/fltk<=1.3.8-1

Event History

Oct 26, 2026

Advisory Published

via OSV·10:16 PM

Data Sourced

via OSV·10:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116724

Frequently Asked Questions

Which deployments are in scope?

The issue affects FLTK through version 1.4.5. The identified Azure Linux package is fltk 1.3.8-1.

What must an attacker be able to do to trigger the flaw?

An attacker needs to provide a crafted BMP or ICO file that the application processes. The file uses large, attacker-controlled dimensions to cause an undersized pixel-buffer allocation and subsequent heap corruption.