CVE-2026-42144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42144", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-24T17:15:21.834Z", "datePublished": "2026-05-04T17:51:38.144Z", "dateUpdated": "2026-05-05T14:14:38.921Z"}, "containers": {"cna": {"title": "CImg Library: Integer overflow in PNM size check bypasses memory guard (_load_pnm)", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc"}, {"name": "https://github.com/GreycLab/CImg/issues/478", "tags": ["x_refsource_MISC"], "url": "https://github.com/GreycLab/CImg/issues/478"}, {"name": "https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d", "tags": ["x_refsource_MISC"], "url": "https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d"}, {"name": "https://github.com/GreycLab/CImg/releases/tag/v.3.7.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/GreycLab/CImg/releases/tag/v.3.7.5"}], "affected": [{"vendor": "GreycLab", "product": "CImg", "versions": [{"version": "< 4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T17:51:38.144Z"}, "descriptions": [{"lang": "en", "value": "CImg Library is a C++ library for image processing. Prior to commit 4ca26bc, there is an integer overflow vulnerability in the W*H*D size computation inside _load_pnm() that can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow. Any application using CImg to load untrusted image files is affected. This issue has been patched via commit 4ca26bc."}], "source": {"advisory": "GHSA-4663-63fm-44gc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-05T13:07:54.801471Z", "id": "CVE-2026-42144", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T14:14:38.921Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-05T13:07:54.801471Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T13:07:59.399Z"}}], "cna": {"title": "CImg Library: Integer overflow in PNM size check bypasses memory guard (_load_pnm)", "source": {"advisory": "GHSA-4663-63fm-44gc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "GreycLab", "product": "CImg", "versions": [{"status": "affected", "version": "< 4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d"}]}], "references": [{"url": "https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc", "name": "https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/GreycLab/CImg/issues/478", "name": "https://github.com/GreycLab/CImg/issues/478", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d", "name": "https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/GreycLab/CImg/releases/tag/v.3.7.5", "name": "https://github.com/GreycLab/CImg/releases/tag/v.3.7.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CImg Library is a C++ library for image processing. Prior to commit 4ca26bc, there is an integer overflow vulnerability in the W*H*D size computation inside _load_pnm() that can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow. Any application using CImg to load untrusted image files is affected. This issue has been patched via commit 4ca26bc."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T17:51:38.144Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42144", "state": "PUBLISHED", "dateUpdated": "2026-05-05T14:14:38.921Z", "dateReserved": "2026-04-24T17:15:21.834Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-04T17:51:38.144Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CImg", "vendor": "GreycLab", "versions": [{"status": "affected", "version": "< 4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CImg Library is a C++ library for image processing. Prior to commit 4ca26bc, there is an integer overflow vulnerability in the W*H*D size computation inside _load_pnm() that can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow. Any application using CImg to load untrusted image files is affected. This issue has been patched via commit 4ca26bc."}, {"lang": "es", "value": "Biblioteca CImg es una biblioteca de C++ para procesamiento de im\u00e1genes. Antes del commit 4ca26bc, existe una vulnerabilidad de desbordamiento de entero en el c\u00e1lculo del tama\u00f1o WHD dentro de _load_pnm() que puede eludir la protecci\u00f3n de asignaci\u00f3n de memoria. Un archivo PNM/PGM/PPM manipulado con valores de dimensi\u00f3n grandes provoca que el desbordamiento se ajuste, asignando un b\u00fafer de tama\u00f1o insuficiente y potencialmente desencadenando un desbordamiento de b\u00fafer en el heap. Cualquier aplicaci\u00f3n que utilice CImg para cargar archivos de imagen no confiables se ve afectada. Este problema ha sido parcheado mediante el commit 4ca26bc."}], "id": "CVE-2026-42144", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42144", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-05T13:07:54.801471Z", "version": "2.0.3"}}]}, "published": "2026-05-04T18:16:31.830", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d"}, {"source": "security-advisories@github.com", "url": "https://github.com/GreycLab/CImg/issues/478"}, {"source": "security-advisories@github.com", "url": "https://github.com/GreycLab/CImg/releases/tag/v.3.7.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "CImg", "source": "cna", "vendor": "GreycLab"}, "product": "cimg", "vendor": "greyclab"}], "created": "2026-05-04T19:30:02.683960+00:00", "updated": "2026-05-04T19:43:44.923967+00:00", "vendors": ["greyclab", "greyclab$PRODUCT$cimg"]}