CVE-2026-94030
Received Received - Intake

Integer Overflow in SerenityOS LibGfx BMP Decoder

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_bmp_pixel_data of the file Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp of the component LibGfx. The manipulation of the argument height leads to integer overflow. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The identifier of the patch is 007041bb2dd6d140c9e707caddfb0a49ecf96469. Applying a patch is the recommended action to fix this issue. This was reproducible with a minimal 55-byte PoC via the standard image-decode fuzz target but evidence for an actual exploitable defect is thin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94030
EUVD
EUVD-2026-83743

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
serenityos serenity to 3d83e4509fd20d7438e1ae8470ffe668c136229c (exc)
serenityos serenity to 3d83e4509fd20d7438e1ae8470ffe668c136229c (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-189

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in SerenityOS's LibGfx library affecting BMP image parsing. It occurs when the height value of a BMP file is set to the minimum signed 32-bit integer (INT_MIN). The abs() function applied to this value causes a signed integer overflow, which is undefined behavior. This flaw was introduced by replacing direct conversion with abs() to ensure positive height values.

Detection Guidance

To detect this vulnerability, inspect BMP files processed by SerenityOS for height values set to INT_MIN (0x80000000). Use tools like file integrity monitors or custom scripts to check for BMP files with invalid height values during image parsing.

Impact Analysis

The impact includes potential denial of service (DoS) due to program aborts under UBSan with halt_on_error enabled. In release builds, it may cause graceful failures like allocation errors. Exploitation requires a specially crafted BMP file with height set to INT_MIN, which is difficult but possible remotely.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a low-severity integer overflow issue in BMP image parsing that could cause crashes or undefined behavior. It does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Apply the patch from commit 007041bb2dd6d140c9e707caddfb0a49ecf96469 to reject BMP files with unrepresentable height values. Update SerenityOS to the latest version to include this fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart