CVE-2026-117555

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-117555", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-27T11:25:20.561Z", "datePublished": "2026-10-27T13:07:51.020Z", "dateUpdated": "2026-11-02T19:13:16.930Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-27T13:07:51.020Z"}, "datePublic": "2026-10-22T00:00:00.000Z", "title": "GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()", "descriptions": [{"lang": "en", "value": "CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}], "affected": [{"vendor": "GreycLab", "product": "CImg", "defaultStatus": "unaffected", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "4.0.6", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cimg:cimg:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.0.6"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/GreycLab/CImg/issues/495", "tags": ["issue-tracking"], "name": "GitHub Issue #495"}, {"url": "https://github.com/GreycLab/CImg", "tags": ["product"]}, {"url": "https://github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5", "tags": ["patch"]}, {"url": "https://github.com/GreycLab/CImg/blob/v.4.0.6/CImg.h#L55659", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/greyclab-cimg-through-4.0.6-heap-out-of-bounds-read-via-integer-overflow-in-load-bmp"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T19:13:01.863819Z", "id": "CVE-2026-117555", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:13:16.930Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-117555", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T19:13:01.863819Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:13:11.153Z"}}], "cna": {"title": "GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "GreycLab", "product": "CImg", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.0.6"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-22T00:00:00.000Z", "references": [{"url": "https://github.com/GreycLab/CImg/issues/495", "name": "GitHub Issue #495", "tags": ["issue-tracking"]}, {"url": "https://github.com/GreycLab/CImg", "tags": ["product"]}, {"url": "https://github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5", "tags": ["patch"]}, {"url": "https://github.com/GreycLab/CImg/blob/v.4.0.6/CImg.h#L55659", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/greyclab-cimg-through-4.0.6-heap-out-of-bounds-read-via-integer-overflow-in-load-bmp", "name": "VulnCheck Advisory: GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cimg:cimg:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "4.0.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-27T13:07:51.020Z"}}}, "cveMetadata": {"cveId": "CVE-2026-117555", "state": "PUBLISHED", "dateUpdated": "2026-11-02T19:13:16.930Z", "dateReserved": "2026-10-27T11:25:20.561Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-27T13:07:51.020Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CImg", "vendor": "GreycLab", "versions": [{"lessThanOrEqual": "4.0.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image."}], "id": "CVE-2026-117555", "lastModified": "2026-11-02T20:17:35.417", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-117555", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T19:13:01.863819Z", "version": "2.0.3"}}]}, "published": "2026-10-27T14:16:36.187", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/GreycLab/CImg"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/GreycLab/CImg/blob/v.4.0.6/CImg.h#L55659"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/GreycLab/CImg/issues/495"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/greyclab-cimg-through-4.0.6-heap-out-of-bounds-read-via-integer-overflow-in-load-bmp"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cimg: cimg: Denial of Service via crafted BMP image", "id": "2561965", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561965"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.", "A flaw was found in cimg. An integer overflow vulnerability in the BMP image loader when calculating row dimensions can trigger an out-of-bounds memory read. An attacker can exploit this flaw by supplying a specially crafted BMP image file to an application using the library, potentially causing an application crash that results in a Denial of Service (DoS), or leaking sensitive heap memory contents into the decoded image."], "name": "CVE-2026-117555", "public_date": "2026-10-27T13:07:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-117555\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-117555\nhttps://github.com/GreycLab/CImg\nhttps://github.com/GreycLab/CImg/blob/v.4.0.6/CImg.h#L55659\nhttps://github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5\nhttps://github.com/GreycLab/CImg/issues/495\nhttps://www.vulncheck.com/advisories/greyclab-cimg-through-4.0.6-heap-out-of-bounds-read-via-integer-overflow-in-load-bmp"], "statement": "This vulnerability is rated as Moderate because exploitation requires a user or service to process an untrusted BMP file, limiting the blast radius to client-side crashes or heap memory disclosure without enabling remote code execution. Red Hat Enterprise Linux does not ship the CImg library in core supported repositories, substantially reducing organizational exposure. The issue primarily affects community-supported packages where applications parse user-supplied image formats.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.6]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "cimg", "vendor": "cimg"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CImg", "source": "cna", "vendor": "GreycLab"}, "product": "cimg", "vendor": "greyclab"}], "created": "2026-10-27T15:00:05.904357+00:00", "updated": "2026-10-30T14:15:08.274015+00:00", "vendors": ["cimg", "cimg$PRODUCT$cimg", "greyclab", "greyclab$PRODUCT$cimg"]}