CVE-2026-42146: CImg Library: Uncontrolled memory allocation via nb_colors field in _load_bmp
CImg Library is a C++ library for image processing. Prior to commit c3aacf5, the nbcolors field read from the BMP file header is used directly to compute an allocation size without validating it against the remaining file size. A crafted BMP file with a large nbcolors value triggers an out-of-memory condition, crashing any application that uses CImg to load untrusted BMP files. This issue has been patched via commit c3aacf5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42146?
CVE-2026-42146 has been classified as a high severity vulnerability due to its potential to lead to uncontrolled memory allocation.
How do I fix CVE-2026-42146?
To resolve CVE-2026-42146, update the CImg Library to a version after commit c3aacf5, which contains the necessary fixes.
What type of vulnerability is CVE-2026-42146?
CVE-2026-42146 is categorized as a memory allocation vulnerability that allows for unchecked allocation based on the nb_colors field.
In which versions of the CImg Library is CVE-2026-42146 present?
CVE-2026-42146 affects all versions of the CImg Library prior to c3aacf5.
What software is affected by CVE-2026-42146?
CVE-2026-42146 impacts the CImg Library used for image processing.