{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116724", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-26T20:23:34.151Z", "datePublished": "2026-10-26T21:52:28.153Z", "dateUpdated": "2026-10-26T21:52:28.153Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T21:52:28.153Z"}, "datePublic": "2026-10-22T00:00:00.000Z", "title": "FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow", "descriptions": [{"lang": "en", "value": "FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}], "affected": [{"vendor": "fltk", "product": "fltk", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "1.4.5"}], "packageURL": "pkg:github/fltk/fltk", "repo": "https://github.com/fltk/fltk"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:fltk_project:fltk:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.4.5"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/fltk/fltk/issues/1632", "tags": ["issue-tracking"], "name": "GitHub Issue #1632"}, {"url": "https://github.com/fltk/fltk", "tags": ["product"]}, {"url": "https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1", "tags": ["patch"]}, {"url": "https://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L281-L286", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/fltk-through-1.4.5-heap-buffer-overflow-via-fl-bmp-image-integer-overflow"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/fltk/fltk", "product": "fltk", "repo": "https://github.com/fltk/fltk", "vendor": "fltk", "versions": [{"lessThanOrEqual": "1.4.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap."}], "id": "CVE-2026-116724", "lastModified": "2026-10-27T15:55:51.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-26T22:16:56.070", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/fltk/fltk"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L281-L286"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/fltk/fltk/issues/1632"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/fltk-through-1.4.5-heap-buffer-overflow-via-fl-bmp-image-integer-overflow"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "fltk: fltk: Arbitrary code execution via integer overflow in BMP image parsing", "id": "2561462", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561462"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in FLTK. An attacker could achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to open a specially crafted BMP or ICO image file. Due to an integer overflow when calculating image dimensions, the application allocates an undersized memory buffer and writes data beyond its boundaries, leading to heap memory corruption."], "name": "CVE-2026-116724", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "fltk", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "fltk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "fltk", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-26T21:52:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116724\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116724\nhttps://github.com/fltk/fltk\nhttps://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L281-L286\nhttps://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1\nhttps://github.com/fltk/fltk/issues/1632\nhttps://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow\nhttps://www.vulncheck.com/advisories/fltk-through-1.4.5-heap-buffer-overflow-via-fl-bmp-image-integer-overflow"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.4.5]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "fltk", "source": "cna", "vendor": "fltk"}, "product": "fltk", "vendor": "fltk_project"}], "created": "2026-10-27T06:45:06.703971+00:00", "updated": "2026-10-27T13:45:02.807880+00:00", "vendors": ["fltk_project", "fltk_project$PRODUCT$fltk"]}