Stack-Based Buffer Overflow in FLTK Image Processing Component
CVE-2026-116723

8.5HIGH

Key Information:

Vendor

Fltk

Status
Fltk
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116723?

FLTK, a widely used C++ GUI toolkit, is impacted by a stack-based buffer overflow vulnerability in its Fl_BMP_Image::load_bmp_() function. This security flaw arises when an attacker supplies a BMP or ICO file with an oversized colors_used field, exceeding the standard limit of 256. The buffer overflow occurs in the 768-byte colormap array, potentially leading to memory corruption, application crashes, or even arbitrary code execution by malicious actors. Users of FLTK version 1.4.5 and below should apply available patches and stay informed about updates to mitigate these risks.

Affected Version(s)

fltk 0 <= 1.4.5

References

https://github.com/fltk/fltk/issues/1632
issue-tracking
https://github.com/fltk/fltk
product
https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737...
patch

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.