This vulnerability is an integer overflow in the Fl_BMP_Image::load_bmp_() function of FLTK versions up to 1.4.5. When a BMP or ICO file contains very large width and height fields, the library allocates a pixel buffer that is too small. Writing decoded pixels into this insufficient buffer overflows the heap, corrupting adjacent memory. An attacker who can supply a crafted image file may therefore cause the application to crash or, potentially, execute arbitrary code by manipulating the corrupted heap data. The weakness involves both a classic integer overflow (CWE‑190) and a heap-based buffer overflow (CWE‑787).

All installations of the FLTK GUI toolkit that use version 1.4.5 or earlier are vulnerable. This includes any software that incorporates those FLTK releases regardless of the host operating system. The issue has been fixed in later releases such as 1.4.6; upgrading to that or newer versions removes the flaw.

The CVSS base score is 8.5, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. Exploitation requires the attacker to supply a malicious BMP or ICO file to a Fl_BMP_Image handler. The attack can be conducted remotely if the application loads images from network sources or untrusted inputs, making it a realistic threat for desktop or server applications that render images without proper validation.