CVE-2026-47667 Details
Description
CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.
A vulnerability exists in the CImg Library's image processing capabilities, specifically in versions through 3.7.6. The issue arises in the '_load_analyze()' function, where the 'header_size' is read from the first four bytes of an Analyze/NIfTI file and directly passed to allocate a buffer without proper size validation. This oversight allows for allocations of up to approximately 4 GB. If the 'fread' function indicates a short read, which occurs with malformed files, the function throws an exception without freeing the allocated memory, leading to a memory leak. This vulnerability can be exploited by any application that uses CImg to load files with the '.hdr', '.img', or '.nii' extensions', especially from untrusted sources.
Users can upgrade to CImg version 4.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GreycLab/CImg/issues/480 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/GreycLab/CImg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee | [email protected] | Source CodeVendor |
| https://github.com/GreycLab/CImg/issues/480 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/GreycLab/CImg/security/advisories/GHSA-rmfc-grgj-qwhv | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GreycLab CImg | <= 3.7.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |