CVE-2026-116723: FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in FlBMPImage::loadbmp() that allows attackers to corrupt stack memory by supplying an oversized BMP colorsused field. Attackers can craft BMP or ICO files with colorsused above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are practically exposed?
Applications using FLTK through 1.4.5 are exposed when they load attacker-supplied BMP or ICO files. The CVSS vector indicates local attack access and required user interaction.
What does an attacker need to provide?
The attacker needs a crafted BMP or ICO file whose colors_used field is greater than 256. Loading that file can overflow the 768-byte colormap array in Fl_BMP_Image::load_bmp_().
How can exposure be reduced before an update is applied?
Avoid loading BMP or ICO files from untrusted sources in affected FLTK applications. Treat crashes while processing such files as a potential indicator of attempted exploitation.