CVE-2026-47667— CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header
Quick assessment
Affected
GreycLab CImg
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GreycLab CImg是GreycLab的C++图像处理库。 GreycLab CImg 4.0.0之前版本存在安全漏洞，该漏洞源于_load_analyze()函数中未对从Analyze/NIfTI文件头部读取的header_size字段进行实际文件大小限制，可能导致内存分配过大且无法释放，进而造成拒绝服务。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47667
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header
Source: CVE Program / CVE List V5
Vulnerability Description
CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5
Vulnerability Title
GreycLab CImg 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GreycLab CImg是GreycLab的C++图像处理库。 GreycLab CImg 4.0.0之前版本存在安全漏洞，该漏洞源于_load_analyze()函数中未对从Analyze/NIfTI文件头部读取的header_size字段进行实际文件大小限制，可能导致内存分配过大且无法释放，进而造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-47667
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 7925 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-47667
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-47667 (1)
Vendor Advisories for CVE-2026-47667 (1)
Other References for CVE-2026-47667 (1)
IV. Related Vulnerabilities
Same weakness: CWE-401
-
CVE-2026-87078
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl -
CVE-2026-94627
vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer -
CVE-2026-73550
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM i -
CVE-2026-63446
Suricata app-layer: passed flows can retain transactions, ca -
CVE-2026-93436
vLLM through 0.29.0 Memory Exhaustion via Rejected Requests
V. Comments for CVE-2026-47667
No comments yet