Description
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Published: 2026-10-26
Score: 8.5 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Title FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field
First Time appeared Fltk Project
Fltk Project fltk
Weaknesses CWE-121
CPEs cpe:2.3:a:fltk_project:fltk:*:*:*:*:*:*:*:*
Vendors & Products Fltk Project
Fltk Project fltk
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Fltk Project Fltk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T21:52:27.469Z

Reserved: 2026-10-26T20:23:34.016Z

Link: CVE-2026-116723

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T22:16:55.923

Modified: 2026-10-26T22:16:55.923

Link: CVE-2026-116723

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses