CVE-2026-116724— FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow

Quick assessment

Affected

fltk fltk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FLTK 1.4.5 及更早版本在函数中存在整数溢出漏洞。该漏洞源于根据文件提供的宽度和高度分配像素缓冲区时计算错误，导致分配的缓冲区过小。攻击者可构造具有超大尺寸信息的 BMP 或 ICO 文件，在解码行数据时，将源自文件的数据写入堆缓冲区之外，从而破坏应用程序的堆内存。

CVSS 7.8 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow

Source: CVE Program / CVE List V5

Vulnerability Description

FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

整数溢出或超界折返

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
fltk	fltk	0 ~ 1.4.5	-

II. Public POCs for CVE-2026-116724

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116724

请登录查看更多情报信息。

Other References for CVE-2026-116724 (6)

FLTK BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP File - HackMD third-party-advisory
Fix "BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP… · fltk/fltk@3a049d8 · GitHub patch
GitHub - fltk/fltk: FLTK - Fast Light Tool Kit - https://github.com/fltk/fltk - cross platform GUI development · GitHub product
fltk/src/Fl_BMP_Image.cxx at release-1.4.5 · fltk/fltk · GitHub technical-description
FLTK BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP File · Issue #1632 · fltk/fltk issue-tracking
FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116724

IV. Related Vulnerabilities

Same product: fltk

CVE-2026-116723
FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image co

Same vendor: fltk

CVE-2026-116723
FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image co

Same weakness: CWE-190