What’s Vulnerable › Vulnerabilities

CVE-2026-117555: GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-27 · updated 2026-10-27
• Weakness: CWE-190

Description

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.

Affected products

• GreycLab CImg: through 4.0.6

References

• https://github.com/GreycLab/CImg
• https://github.com/GreycLab/CImg/blob/v.4.0.6/CImg.h#L55659
• https://github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5
• https://github.com/GreycLab/CImg/issues/495
• https://www.vulncheck.com/advisories/greyclab-cimg-through-4.0.6-heap-out-of-bounds-read-via-integer-overflow-in-load-bmp

Get alerted when CVE-2026-117555 or the next vulnerability affects your stack