Description
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Published: 2026-10-26
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via Stack Buffer Overflow
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a stack‑based buffer overflow in the Fl_BMP_Image::load_bmp_() routine of FLTK versions up to and including 1.4.5. When a BMP or ICO file contains a colors_used value of more than 256, the function writes past the 768‑byte colormap array on the stack. This memory corruption can cause crashes or, if an attacker can control the overwritten data, potentially lead to arbitrary code execution. The weakness is classified as CWE‑121.

Affected Systems

Any deployment that links against FLTK 1.4.5 or earlier and uses the Fl_BMP_Image class to load BMP or ICO images is affected. Applications that accept user‑supplied images—such as graphical editors, image viewers, or any software that embeds the FLTK image loader—could process malicious files and trigger the overflow.

Risk and Exploitability

The CVSS score of 8.5 denotes a high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that no privileged execution is required; an attacker simply needs to supply a crafted BMP/ICO file to an application that invokes the loader. Once the file is processed, the overflow may crash the application or allow code execution, depending on how the corrupted stack is used.

Generated by OpenCVE AI on October 27, 2026 at 08:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FLTK to a version newer than 1.4.5 where the colors_used field is validated against a 256 limit.
  • If upgrading is not immediately possible, remove or disable all code paths that load BMP/ICO files using Fl_BMP_Image, or replace this image handling with a validated alternative library.
  • If neither upgrading nor disabling image loading is feasible, add input validation to reject BMP files whose colors_used field exceeds 256 before invoking Fl_BMP_Image::load_bmp_().

Generated by OpenCVE AI on October 27, 2026 at 08:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Title FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field
First Time appeared Fltk Project
Fltk Project fltk
Weaknesses CWE-121
CPEs cpe:2.3:a:fltk_project:fltk:*:*:*:*:*:*:*:*
Vendors & Products Fltk Project
Fltk Project fltk
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Fltk Project Fltk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T21:52:27.469Z

Reserved: 2026-10-26T20:23:34.016Z

Link: CVE-2026-116723

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T22:16:55.923

Modified: 2026-10-26T22:16:55.923

Link: CVE-2026-116723

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-26T21:52:27Z

Links: CVE-2026-116723 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T08:45:14Z

Weaknesses