{"schema":"threatline.record/2","record":{"id":"CVE-2026-116723","aliases":[],"summary":"FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field","details":"FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.","categories":["Unclassified"],"product":"fltk","vendor":"fltk","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116723","source_modified_at":"2026-10-26T21:52:27.469Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"fltk","vendor":"fltk","versions":[{"version":"0","status":"affected","versionType":"custom","lessThanOrEqual":"1.4.5"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.5,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T21:52:27.469Z","modified_at":"2026-10-26T21:52:27.469Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116723","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T21:52:27.469Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/fltk/fltk/issues/1632","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/fltk/fltk","tags":["product"]},{"source":"CVE List","url":"https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1","tags":["patch"]},{"source":"CVE List","url":"https://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L255-L265","tags":["technical-description"]},{"source":"CVE List","url":"https://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/fltk-through-1.4.5-stack-buffer-overflow-via-fl-bmp-image-colors-used-field","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T21:52:27.469Z","content_hash":"db9570d75f52bcf8ad42345bd8598d7bc485bed4b53a83db48c3db8bbfdd5ca5"}}