CVE-2026-117555: GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()
CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the loadbmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dxbytes, causing crashes or heap memory disclosure into the decoded image.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using CImg through version 4.0.6 that decode BMP files are exposed when they process attacker-controlled or otherwise untrusted BMP input.
What does an attacker need to exploit it?
An attacker needs to induce the application to load a crafted BMP file with a sufficiently large width value in its header. The published vector indicates local attack access and user interaction are required.
What could happen if exploitation succeeds?
The integer overflow can make the BMP row byte count wrap, leading to a heap out-of-bounds read. This can crash the application or disclose heap memory through the decoded image.
How can I identify potentially affected deployments?
Check whether the application includes or depends on CImg version 4.0.6 or earlier and uses the _load_bmp() BMP decoding path. Review whether those deployments accept BMP files from users or other untrusted sources.