UBUNTU-CVE-2026-116723: Buffer Overflow
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in FlBMPImage::loadbmp() that allows attackers to corrupt stack memory by supplying an oversized BMP colorsused field. Attackers can craft BMP or ICO files with colorsused above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Affected Software
Event History
Frequently Asked Questions
Which Ubuntu packages should be prioritized for assessment?
The affected software list includes ubuntu/fltk1.3 and ubuntu/fltk1.4. FLTK versions through 1.4.5 are identified as vulnerable.
What does an attacker need to exploit this issue?
The attack vector is local and requires user interaction, but no attacker privileges are required. Exploitation involves supplying a crafted BMP or ICO file for processing.
What file characteristic indicates an attempted exploit?
A malicious BMP or ICO can specify a colors_used value above 256. This value can overflow the 768-byte colormap array during BMP image loading.