Uncontrolled memory allocation and leak in CImg Library `_load_analyze()` (CVE-2026-47667)

In CImg Library prior to version 4.0.0, the `_load_analyze()` function reads a `header_size` field from the first 4 bytes of an Analyze/NIfTI file and passes it directly to a heap allocation without bounding it against the actual file size, allowing values up to approximately 4 GB. When a subsequent read fails on a malformed file, a `CImgIOException` is thrown and the allocated buffer is never freed, resulting in a memory leak on every error path. A 6-byte crafted file is sufficient to trigger an allocation of approximately 1.3 GB per call, reachable via `load_analyze()` or the generic `load()` function for files with extensions `.hdr`, `.img`, or `.nii`, enabling denial of service through memory exhaustion. Affected versions: - <= 3.7.6 (commit 48962cb) We recommend updating to: commit 6a69bf7. CVSS 7.5 · our assessment: this_week Reference: https://github.com/GreycLab/CImg/security/advisories/GHSA-rmfc-grgj-qwhv Details: https://vuln.today/cve/CVE-2026-47667