CVE-2026-116723
High
Description
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.
SeverityHigh
CVSS7.8
Exploit probability—
ProductFltk
PublishedOct 26, 2026
First seenOct 26, 2026
Weakness typeCWE-121CWE-121
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fltk fltk | v ≤ 1.4.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.