CVE-2026-117555

Medium

Description

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.

SeverityMedium

CVSS6.1

Exploit probability—

ProductCImg

PublishedOct 27, 2026

First seenOct 27, 2026

Weakness typeCWE-190Integer overflow

How to fix

Patches

github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5

Affected products

Product	Affected versions	Fixed in
GreycLab CImg	v ≤ 4.0.6	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.