CImg Library CVE-2026-47667

Exploitation requires that the target application pass attacker-supplied data to CImg's Analyze/NIfTI loader - either an explicit load_analyze() call or the generic load() with a filename ending in .hdr, .img, or .nii - using a CImg build prior to 4.0.0. The malicious file only needs a crafted 4-byte header_size (up to ~4 GB) and to be truncated/malformed so the subsequent fread short-reads and throws. Limiting factors: the attack surface exists only where untrusted files reach the Analyze/NIfTI path, so the AV:N/PR:N/UI:N profile holds fully only for automated, unauthenticated file-ingestion services; interactive desktop use effectively requires the victim to open the file (user interaction), and applications that never call the Analyze loader are not exposed regardless of CImg version.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) correctly scopes this as an availability-only issue - no confidentiality or integrity impact - despite the source Tags labeling it 'Information Disclosure', which is inconsistent with the memory-leak root cause and the C:N/I:N metrics and should be disregarded. No EPSS score and no KEV status were supplied; treat exploitation probability as unquantified but note there is no evidence of active exploitation. The real-world severity is highly deployment-dependent: AV:N and PR:N/UI:N are only realistic where an internet-facing service auto-processes untrusted uploads through CImg's Analyze/NIfTI path; in a desktop tool requiring a user to open a file, effective exploitability drops (user interaction in practice). The impact is also a slow-burn resource-exhaustion DoS (leak accumulates over repeated calls) rather than an instant crash or code execution, so it is a genuine but moderate priority - patch on normal cadence unless CImg sits behind an unauthenticated file-processing endpoint.

An attacker uploads a tiny (as small as 6-byte) file with a .nii, .hdr, or .img extension whose first 4 bytes encode a near-maximal header_size to a service that processes images through CImg; the loader allocates ~1.3 GB, the truncated read throws, and the buffer is leaked. Repeating the upload a handful of times exhausts server RAM and causes an out-of-memory denial of service. No public exploit is identified at time of analysis, but the trigger is trivial to reproduce given the low attack complexity (AC:L).