CVE-2026-116723 Details
Description
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
A stack-based buffer overflow vulnerability has been identified in the Fast Light Tool Kit (FLTK) version 1.4.5 and prior, within the BMP image loader component. The issue arises in the function Fl_BMP_Image::load_bmp_() due to improper handling of the colors_used field in the BMP header. Attackers can exploit this vulnerability by crafting BMP or ICO files that include a colors_used value exceeding 256. This oversight allows for the overflow of a 768-byte colormap array, leading to corruption of stack memory, application crashes, or potentially facilitating code execution.
Users can update to FLTK version 1.5.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow | CISA-ADP | BundleExploitRemedyTechnical Analysis |
| https://github.com/fltk/fltk | [email protected] | Vendor |
| https://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L255-L265 | [email protected] | Source CodeVendor |
| https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1 | [email protected] | Source CodeVendor |
| https://github.com/fltk/fltk/issues/1632 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/fltk-through-1.4.5-stack-buffer-overflow-via-fl-bmp-image-colors-used-field | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FLTK | <= 1.4.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |