CVE-2026-116724: FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow
FLTK through 1.4.5 contains an integer overflow vulnerability in FlBMPImage::loadbmp() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to get a user to open or otherwise process a crafted BMP or ICO file in an application using the affected FLTK image-loading code. The vulnerability is locally exploitable and requires user interaction, but no attacker privileges are required.
Which deployments should be treated as affected?
FLTK versions through 1.4.5 are affected. Applications that use FLTK to load BMP or ICO files should be assessed, especially where those files can come from untrusted sources.
What can be done while a fix is being deployed?
Avoid opening BMP or ICO files from untrusted sources in affected applications. Where possible, restrict or validate image inputs before they reach FLTK's BMP loader.
How can I determine whether an application is exposed?
Identify the FLTK version used by the application and whether it processes BMP or ICO images. An application using FLTK through 1.4.5 with untrusted or user-supplied image input should be treated as exposed.