Heap Out-of-Bounds Read in CImg via BMP File

Executive Summary

CVE-2026-117555 is a heap out-of-bounds read vulnerability in CImg through version 4.0.6. It occurs in the _load_bmp() function due to an integer overflow in the row byte count. Attackers can exploit this by providing a specially crafted BMP file with an excessively large header width. This causes the row byte count to wrap around, leading to crashes or the disclosure of heap memory within the decoded image.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a heap out-of-bounds read in CImg when processing crafted BMP files. To detect it, inspect network traffic or system logs for unusual BMP file handling. Use tools like file integrity monitors or antivirus software to scan for suspicious BMP files. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing application crashes when processing malicious BMP files. It may also lead to sensitive information being exposed from the program's memory, potentially including data unrelated to the image itself. Attackers could use this to gather information or disrupt services.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update CImg to the latest version (4.0.6 or later) to patch the heap out-of-bounds read issue. Avoid processing untrusted BMP files until patched. Monitor for crashes or memory disclosures during image processing as potential exploitation signs.

Useful 0 Not Useful 0