CVE-2026-42144: CImg Library: Integer overflow in PNM size check bypasses memory guard (_load_pnm)
CImg Library is a C++ library for image processing. Prior to commit 4ca26bc, there is an integer overflow vulnerability in the WHD size computation inside loadpnm() that can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow. Any application using CImg to load untrusted image files is affected. This issue has been patched via commit 4ca26bc.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42144?
The CVE-2026-42144 vulnerability is considered to have a medium severity due to its potential to bypass memory allocation guards.
How do I fix CVE-2026-42144?
To fix CVE-2026-42144, update the CImg Library to a version that includes commit 4ca26bc or later.
What type of vulnerability is CVE-2026-42144?
CVE-2026-42144 is an integer overflow vulnerability that affects the image size computation in the _load_pnm function.
Who is affected by CVE-2026-42144?
CVE-2026-42144 affects users of the CImg Library versions prior to commit 4ca26bc.
What is the potential impact of CVE-2026-42144?
The potential impact of CVE-2026-42144 includes memory corruption and possible exploitation that could affect application stability.