FLTK: Heap buffer overflow via integer overflow in BMP image loader

Summary

FLTK, a C++ GUI toolkit, contains an integer overflow in Fl_BMP_Image::load_bmp_(), which loads BMP and ICO image files. A crafted file with large width and height values causes an undersized pixel buffer to be allocated, so row decoding writes file-derived data past the heap buffer and corrupts the application heap. Exploitation requires that a user opens or loads the crafted file in an application that uses FLTK.

Affected

• FLTK through 1.4.5 (CVE record)
• Azure Linux lists fltk 1.3.8-1 as the last affected version (distribution data)
• Red Hat Enterprise Linux 7 is listed as affected by a third-party copy of Red Hat data; RHEL 8 and the Red Hat advisory were not confirmed

Fixed in

Unknown: the exact first fixed version is not verified.

• Upstream commit 3a049d8 is referenced for this issue; the maintainer stated it would ship in FLTK 1.5.
• VulDB and OpenCVE recommend FLTK 1.4.6 or later, but a 1.4.6 release could not be verified.
• Check https://github.com/fltk/fltk/releases and https://www.fltk.org for the current fixed release.

Workaround

Unknown: no vendor-published mitigation found.

• Until patched, do not open BMP or ICO files from untrusted sources (email, web downloads, external shares) in FLTK-based applications.
• Run such applications with least privilege.

Exploitation

• Not listed in the CISA KEV catalogue; EPSS below 1%.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• The reporter performed a static source review and states that no runtime exploit was developed.
• No exploitation in the wild found.
• OpenCVE labels the impact Remote Code Execution, but code execution is not confirmed in the sources.

Our recommendation

• Inventory in-house and third-party applications that link FLTK, including older 1.3.x builds shipped by Linux distributions.
• Update affected applications to a fixed FLTK version as soon as one is confirmed, and apply the related fix CVE-2026-116723 at the same time.
• Until then, block or restrict BMP and ICO files from untrusted sources in these applications.
• Monitor the FLTK releases page and vendor advisories for the fixed version.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• FLTK upstream commit 3a049d8 github.com
• FLTK issue 1632 github.com
• FLTK source Fl_BMP_Image.cxx (release-1.4.5) github.com
• FLTK GitHub repository github.com
• OSV Azure Linux entry AZL-111109 osv.dev
• VulDB CVE-2026-116724 vuldb.com
• OpenCVE CVE-2026-116724 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:04.