CVE-2026-42146: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-42146 is an uncontrolled memory allocation vulnerability in the CImg Library (GreycLab/CImg), a C++ image processing library. The flaw exists in the _load_bmp() function, where the nb_colors field from a BMP file header is used directly to compute an allocation size without validation against the actual remaining file size. A crafted BMP file with an inflated nb_colors value can trigger an out-of-memory (OOM) condition, crashing any application that uses CImg to load untrusted BMP files. The vulnerability was reported on April 14, 2026, the advisory was published April 20, 2026, and the CVE was assigned May 4, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-789 (Memory Allocation with Excessive Size Value). In CImg.h around line 56645, nb_colors is read from bytes 0x2E–0x31 of the BITMAPINFOHEADER as a signed integer and passed directly to colormap.assign(nb_colors). The only existing guard checks for nb_colors == 0; any non-zero value bypasses validation. With nb_colors = 0x3FFFFFFF and bpp = 8, the call attempts to allocate approximately 4 GB — a value that stays under CImg's internal cimg_max_buf_size limit (16 GB on 64-bit systems), so no internal rejection occurs and the process exhausts available memory. Exploitation requires a user or application to open a specially crafted BMP file (GitHub Issue #477, GitHub Advisory).

Successful exploitation causes an out-of-memory crash in any application that uses CImg to process untrusted BMP files, resulting in a denial of service (DoS). There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Applications in image processing pipelines, media viewers, or web services that accept user-supplied BMP files are at risk of process termination or system instability (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-42146. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must open a crafted BMP file — limiting the attack surface to local or socially engineered scenarios (GitHub Advisory).

1. Craft a malicious BMP file: Create a BMP file with a BITMAPINFOHEADER where bytes 0x2E–0x31 encode a large nb_colors value (e.g., 0x3FFFFFFF) and bpp is set to 8 or another value less than 16 to trigger the colormap allocation path.
2. Deliver the file to the target: Use social engineering, a malicious upload form, or any other vector to get the target application or user to open the crafted BMP file with a CImg-based application.
3. Trigger the vulnerable code path: When the application calls _load_bmp(), CImg reads nb_colors from the header and calls colormap.assign(0x3FFFFFFF), attempting to allocate ~4 GB of memory.
4. Achieve denial of service: The process exhausts available system memory, resulting in an OOM crash and application termination (GitHub Issue #477, GitHub Advisory).

• Logs: Application crash logs or core dumps referencing CImg::assign() or _load_bmp() stack frames; OOM killer (oom-kill) entries in system logs (/var/log/syslog, dmesg) pointing to a CImg-based process.
• File System: Presence of unexpected or anomalous .bmp files submitted to image processing directories, particularly files with unusually small actual size but large declared color table values.
• Process: Sudden termination or high memory consumption spike in processes that handle image loading, followed by restart or crash; memory allocation failures logged by the application runtime.

The fix is available in commit c3aacf5b96ac1e54b7af1957c6737dbf3949f6d3, which clamps nb_colors to the maximum valid value for the given bpp before allocation, and sets it to zero for bpp >= 16. Users should update to CImg v3.7.5 or later, or apply the patch from the fix commit directly. As a workaround, avoid loading untrusted BMP files with CImg until the patch is applied (GitHub Advisory, CImg v3.7.5 Release, Fix Commit).

The vulnerability was discovered and reported by researcher JorgeBarredo14 via GitHub Issue #477, who also provided a detailed fix suggestion that closely matches the patch ultimately applied by the maintainer. The issue was addressed promptly by CImg maintainer dtschump. Downstream distributions including Debian and Fedora have issued updates incorporating the fix (GitHub Issue #477).