UBUNTU-CVE-2026-116724: Integer Overflow
FLTK through 1.4.5 contains an integer overflow vulnerability in FlBMPImage::loadbmp() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ubuntu systems using the fltk1.3 or fltk1.4 packages are affected if an application built with FLTK loads attacker-controlled BMP or ICO image files.
What does an attacker need to exploit it?
The attacker needs to get a crafted BMP or ICO file with large width and height values processed by a vulnerable FLTK application. The CVSS vector indicates local access and user interaction are required, while no privileges are required.
Are default installations affected?
The available data identifies the affected Ubuntu packages but does not state whether they are installed or used by default. Exposure depends on whether a vulnerable application processes BMP or ICO files.
What can be done if patching is not immediately possible?
Avoid opening BMP or ICO files from untrusted sources in applications that use the affected FLTK packages. Restrict those applications from processing externally supplied image files where possible.