CVE-2026-42144 Details
Description
CImg Library is a C++ library for image processing. Prior to commit 4ca26bc, there is an integer overflow vulnerability in the W*H*D size computation inside _load_pnm() that can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow. Any application using CImg to load untrusted image files is affected. This issue has been patched via commit 4ca26bc.
A vulnerability allowing integer overflow has been identified in the CImg Library, a C++ library for image processing. This issue arises in the '_load_pnm()' function, where the width, height, and depth dimensions of PNM/PGM/PPM files are processed. Prior to commit 4ca26bc, the size check in '_load_pnm()' compared the declared pixel count, calculated using unsigned integers, against the actual file size. This comparison allowed oversized images to bypass the memory allocation guard, leading to a heap buffer overflow. The vulnerability can be exploited by crafting a PNM/PGM/PPM file with large dimension values, causing the overflow to wrap around and allocate an undersized buffer. Any application using CImg to load untrusted image files is affected.
Users should update to the latest version of the CImg library, as this vulnerability has been fixed in commit 4ca26bc.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d | [email protected] | Source CodeVendor |
| https://github.com/GreycLab/CImg/issues/478 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/GreycLab/CImg/releases/tag/v.3.7.5 | [email protected] | Release NotesVendor |
| https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GreycLab CImg | < 4ca26bc |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |