CVE-2026-117555: 
Chainguard vulnerability analysis and mitigation

CVE-2026-117555 is a heap out-of-bounds read vulnerability in the CImg library's BMP image loader, caused by an integer overflow in the row byte count calculation. It affects CImg versions through 4.0.6, developed by GreycLab. The vulnerability was discovered by researcher HaiND (Nguyen Dinh Hai) of the Post and Telecommunication Institute of Technology via static source review and reported on October 22, 2026; a fix was committed on October 26, 2026, and the CVE was published on October 27, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Feedly, VulnCheck Advisory).

The root cause is an integer overflow (CWE-190) in the _load_bmp() function of CImg.h at approximately line 55659 in version 4.0.6. The vulnerable code computed dx_bytes using a signed int multiplication of the image width (dx) and bits-per-pixel (bpp), which could wrap around to a small or negative value when a BMP file header specifies a very large width. This wrapped dx_bytes value was then used to calculate buf_size and allocate/read heap memory, causing reads beyond the allocated buffer boundary. The fix (commit b9ed613) rewrites all header field parsing to use 64-bit unsigned arithmetic (ulongT/longT) and adds explicit overflow guards before any buffer size computation, preventing the wraparound (GitHub Issue #495, Fix Commit).

Successful exploitation can result in application crashes (denial of service) due to invalid memory access, or disclosure of heap memory contents embedded into the decoded image output, potentially exposing sensitive in-process data. The vulnerability requires local access and user interaction (opening a malicious BMP file), limiting its scope; however, applications that automatically process user-supplied image files — such as image editors, converters, or web services using CImg — may be exposed to remote file delivery scenarios. Integrity is not directly affected (Feedly, VulnCheck Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported; the original researcher explicitly noted the vulnerability was identified through static source review with no runtime exploit developed (GitHub Issue #495). The EPSS score is 0.0, indicating very low probability of near-term exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly). No threat actor attribution is available.

1. Craft a malicious BMP file: Create a BMP file with a header specifying an extremely large image width value (e.g., close to 0xFFFFFFFF) such that when multiplied by the bits-per-pixel value in a signed 32-bit integer, the result wraps around to a small or negative value for dx_bytes.
2. Deliver the file to the target: Provide the crafted BMP file to a victim application that uses CImg ≤ 4.0.6 to load BMP images — this could be via email attachment, file share, web upload form, or direct file placement.
3. Trigger BMP loading: Cause the application to call CImg::load_bmp() or a wrapper (e.g., CImg::load()) on the malicious file, entering the vulnerable _load_bmp() code path in CImg.h.
4. Integer overflow occurs: The vulnerable dx_bytes calculation wraps, producing an undersized buffer allocation while the subsequent buf_size calculation uses the wrapped value.
5. Heap out-of-bounds read: The library reads pixel row data beyond the allocated heap buffer, either causing a crash (denial of service) or embedding adjacent heap memory into the decoded image object, which may then be returned to the caller or written to an output file, leaking heap contents (GitHub Issue #495, Fix Commit).

• File System: Presence of BMP files with anomalously large width values in the BMP header (bytes 0x12–0x15 set to values near 0xFFFFFFFF) in directories processed by CImg-based applications.
• Process: Application crashes or segmentation faults in processes loading BMP images via CImg; core dump files generated by the affected process.
• Logs: Application error logs showing CImgIOException messages related to load_bmp() with unexpected file size or dimension mismatches (post-patch behavior); crash reports referencing CImg.h around line 55659 in stack traces (pre-patch).
• Network: Unexpected inbound delivery of BMP files to file upload endpoints or email gateways, particularly files with unusually small actual file sizes relative to their declared image dimensions.

The maintainer (dtschump) committed a fix in commit b9ed613 on October 26, 2026, which is included in versions of CImg after 4.0.6. Users should update to the latest version of CImg from the official repository post-commit b9ed613. As a workaround where upgrading is not immediately possible, applications should validate BMP file headers (particularly image width and bits-per-pixel fields) before passing files to CImg, or restrict accepted image formats to exclude BMP input from untrusted sources (Fix Commit, VulnCheck Advisory).

The vulnerability was responsibly disclosed by researcher HaiND via a GitHub issue with a detailed technical write-up on HackMD, and the maintainer responded promptly by committing a fix within four days of the report (GitHub Issue #495). No significant broader media coverage, vendor statements beyond the fix commit, or notable social media discussion has been identified for this vulnerability.