The vulnerability is an integer overflow in CImg’s BMP loader that causes a heap out‑of‑bounds read when a BMP file has an excessively large header width. An attacker who can supply such a crafted file can cause buffer reads beyond allocated memory, potentially leaking heap data or crashing the application during image decoding.

GreycLab’s CImg library up to and including version 4.0.6 is affected. Any system that imports and uses this library to process BMP images, without vetting input, is potentially vulnerable.

The CVSS score of 6.9 indicates moderate severity and the absence of an EPSS score means the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active attacks at this time. Based on the description, the likely attack vector is local or remote execution of the vulnerable library with a malicious BMP file; the attack requires the ability to supply a file to the application but does not require privileged access.