CVE-2026-42146

CImg Library is a C++ library for image processing. Prior to commit c3aacf5, the nb_colors field read from the BMP file header is used directly to compute an allocation size without validating it against the remaining file size. A crafted BMP file with a large nb_colors value triggers an out-of-memory condition, crashing any application that uses CImg to load untrusted BMP files. This issue has been patched via commit c3aacf5.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/GreycLab/CImg/commit/c3aacf5b96ac1e54b7af1957c6737dbf3949f6d3
https://github.com/GreycLab/CImg/issues/477
https://github.com/GreycLab/CImg/releases/tag/v.3.7.5
https://github.com/GreycLab/CImg/security/advisories/GHSA-g54r-qmgx-c6fv
https://github.com/GreycLab/CImg/issues/477

Configurations

No configuration.

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) CImg Biblioteca es una biblioteca de C++ para procesamiento de imágenes. Antes del commit c3aacf5, el campo nb_colors leído del encabezado del archivo BMP se utiliza directamente para calcular un tamaño de asignación sin validarlo contra el tamaño restante del archivo. Un archivo BMP manipulado con un valor grande de nb_colors desencadena una condición de falta de memoria, provocando el bloqueo de cualquier aplicación que utilice CImg para cargar archivos BMP no confiables. Este problema ha sido parcheado mediante el commit c3aacf5.

Information

Published : 2026-05-04 18:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-42146

Mitre link : CVE-2026-42146

CVE.ORG link : CVE-2026-42146

JSON object : View

Products Affected

No product.

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-42146", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42146", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T13:43:28.189688Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "GreycLab", "product": "CImg", "versions": [{"status": "affected", "version": "< c3aacf5b96ac1e54b7af1957c6737dbf3949f6d3"}]}]}], "published": "2026-05-04T18:16:31.977", "references": [{"url": "https://github.com/GreycLab/CImg/commit/c3aacf5b96ac1e54b7af1957c6737dbf3949f6d3", "source": "security-advisories@github.com"}, {"url": "https://github.com/GreycLab/CImg/issues/477", "source": "security-advisories@github.com"}, {"url": "https://github.com/GreycLab/CImg/releases/tag/v.3.7.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/GreycLab/CImg/security/advisories/GHSA-g54r-qmgx-c6fv", "source": "security-advisories@github.com"}, {"url": "https://github.com/GreycLab/CImg/issues/477", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "CImg Library is a C++ library for image processing. Prior to commit c3aacf5, the nb_colors field read from the BMP file header is used directly to compute an allocation size without validating it against the remaining file size. A crafted BMP file with a large nb_colors value triggers an out-of-memory condition, crashing any application that uses CImg to load untrusted BMP files. This issue has been patched via commit c3aacf5."}, {"lang": "es", "value": "CImg Biblioteca es una biblioteca de C++ para procesamiento de im\u00e1genes. Antes del commit c3aacf5, el campo nb_colors le\u00eddo del encabezado del archivo BMP se utiliza directamente para calcular un tama\u00f1o de asignaci\u00f3n sin validarlo contra el tama\u00f1o restante del archivo. Un archivo BMP manipulado con un valor grande de nb_colors desencadena una condici\u00f3n de falta de memoria, provocando el bloqueo de cualquier aplicaci\u00f3n que utilice CImg para cargar archivos BMP no confiables. Este problema ha sido parcheado mediante el commit c3aacf5."}], "lastModified": "2026-10-26T19:10:00.163", "sourceIdentifier": "security-advisories@github.com"}