CVE-2026-47667
Received Received - Intake

Memory Allocation Failure in CImg Library

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-47667

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
greyclab cimg 3.7.6
greyclab cimg 4.0.0
greyclab cimg 377

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47667 is a memory corruption vulnerability in the CImg library's `_load_analyze()` function. It occurs when processing Analyze/NIfTI image files. The function reads an unsigned integer `header_size` from the first 4 bytes of a file without proper validation and allocates a buffer of that size. If the file is malformed and the read operation fails, the function throws an exception but does not free the allocated memory, causing a memory leak. A 6-byte crafted file can trigger an allocation of ~1.3 GB per call.

Detection Guidance

To detect this vulnerability, monitor for processes using the CImg library that handle .hdr, .img, or .nii files. Check for unusually high memory usage or crashes in applications processing these files. Use tools like 'ps', 'top', or 'htop' to observe memory consumption by suspicious processes.

Impact Analysis

This vulnerability can lead to memory exhaustion on servers or containers, especially if malicious files are processed repeatedly. It may cause out-of-memory (OOM) kills or gradual memory consumption, potentially disrupting services. The impact is primarily on availability due to uncontrolled memory allocation and leaks.

Compliance Impact

This vulnerability primarily impacts availability due to memory exhaustion, which could lead to system crashes or denial-of-service conditions. While not directly violating GDPR or HIPAA, such disruptions may hinder compliance with data processing integrity requirements under GDPR Article 5 and HIPAA Security Rule integrity standards. Memory leaks could also indirectly affect confidentiality if sensitive data remains in memory during crashes.

Mitigation Strategies

Immediately upgrade the CImg library to version 4.0.0 or later. If upgrading is not possible, restrict access to files with .hdr, .img, or .nii extensions in applications using CImg. Implement input validation to reject malformed files before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart