CVE-2026-116723
FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field
fltk fltk
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
Text from CVE List
Affected versions 1
- fltkaffected: all versions through 1.4.5CVE List
References 6
- github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1Fixvia CVE List
- hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflowAdvisoryvia CVE List
- vulncheck.com/advisories/fltk-through-1.4.5-stack-buffer-overflow-via-fl-bmp-image-colors-used-fieldAdvisoryvia CVE List
- github.com/fltk/fltk/issues/1632Referencevia CVE List
- github.com/fltk/fltkReferencevia CVE List
- github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L255-L265Referencevia CVE List