{"id":"CVE-2026-116724","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-116724","summary":"FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow","details":"FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.","published":"2026-10-26T21:52:28.153Z","modified":"2026-10-27T19:02:44.917294408Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1","label":"fltk/fltk@3a049d8"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116724.json"},{"type":"PACKAGE","url":"https://github.com/fltk/fltk"},{"type":"ARTICLE","url":"https://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L281-L286"},{"type":"FIX","url":"https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1"},{"type":"REPORT","url":"https://github.com/fltk/fltk/issues/1632"},{"type":"ADVISORY","url":"https://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116724"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/fltk-through-1.4.5-heap-buffer-overflow-via-fl-bmp-image-integer-overflow"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-27T19:02:44.917294408Z"}}