What is the CVSS score of CVE-2026-47667?

CVE-2026-47667 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of CImg Library are affected by CVE-2026-47667?

CImg, a widely-used C++ image-processing library, contains a denial-of-service vulnerability in all versions prior to 4.0.0 that allows attackers to exhaust server memory through specially crafted…. A patch is available.

How to fix or mitigate CVE-2026-47667?

Within 24 hours, audit all internal and customer-facing services to identify CImg dependencies and document any that process medical imaging files; restrict file inputs to known-safe formats if .hdr/.img/.nii processing is not business-critical. Within 7 days, implement strict file size limits on image upload endpoints (reject files exceeding 50 MB), enforce per-process memory quotas on CImg operations, and rate-limit file upload endpoints; notify customers of the vulnerability. Within 30 days, monitor vendor security advisories for CImg 4.0.0 release or security patch and upgrade immediately upon availability; conduct code review of all CImg file-processing paths for additional input-validation gaps.

CImg Library CVE-2026-47667

EUVD-2026-46392 HIGH

Memory Leak (CWE-401)

2026-07-21 GitHub_M

Information Disclosure Cimg

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Trivial crafted file (AC:L) processed by an unauthenticated network file service (AV:N/PR:N/UI:N) causes memory-exhaustion DoS only, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 21, 2026 - 23:36 EUVD

Source Code Evidence Fetched

Jul 21, 2026 - 20:39 vuln.today

Analysis Generated

Jul 21, 2026 - 20:39 vuln.today

CVE Published

Jul 21, 2026 - 19:57 cve.org

HIGH 7.5

DescriptionCVE.org

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in _load_analyze(), the header_size field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned char[header_size] without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent fread returns short as it will for any malformed file), the function throws a CImgIOException and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via load_analyze() and the generic load() when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

AnalysisAI

Denial-of-service via unbounded memory allocation and leak in the CImg C++ image-processing library affects all versions prior to 4.0.0. In _load_analyze(), a 4-byte attacker-controlled header_size field from an Analyze/NIfTI (.hdr/.img/.nii) file is passed straight to a heap allocation of up to ~4 GB with no check against real file size; when the subsequent short read throws a CImgIOException the buffer is never freed, leaking the full allocation on every call. No public exploit identified at time of analysis and no KEV/EPSS signals were provided, but a 6-byte crafted file reliably leaks ~1.3 GB per invocation, enabling memory-exhaustion DoS against any service that feeds untrusted files to CImg.

Technical ContextAI

CImg (greyclab:cimg) is a widely used single-header, open-source C++ library for image processing embedded in desktop, scientific, and medical-imaging applications. The flaw is in the Analyze 7.5 / NIfTI-1 loader (_load_analyze), reachable through load_analyze() and the generic load() dispatcher when a file carries the .hdr, .img, or .nii extension. The Analyze/NIfTI header begins with a 4-byte little-endian integer giving the header length; the code reads this as an unsigned int and calls new unsigned char[header_size] before validating it against the actual file size, so a value up to ~4 GB is honored. This maps to CWE-401 (Missing Release of Memory after Effective Lifetime): the exception thrown by the failed fread exits the function on a path that predates the delete[] header, so the large allocation is orphaned. The 4.0.0 fix (commit 6a69bf725ffd) both bounds header_size against the file size (fsiz) and switches every raw new[]/delete[] buffer in the loader to RAII-managed CImg<T> objects, so allocations are released automatically even on exception paths.

RemediationAI

Vendor-released patch: upgrade to CImg 4.0.0 or later, which bounds header_size against the actual file size and converts the loader's manual allocations to RAII-managed CImg<T> buffers so nothing leaks on error paths; because CImg is header-only, rebuild and redeploy every application that embeds it after updating CImg.h (per commit 6a69bf725ffd111a4c7dc61cc15e3661abd158ee and advisory GHSA-rmfc-grgj-qwhv). If you cannot upgrade immediately, apply specific compensating controls: refuse or gate files with .hdr, .img, and .nii extensions before they reach load()/load_analyze() (side effect: legitimate Analyze/NIfTI users lose that format); enforce an upstream file-size and upload-rate limit so a 6-byte file cannot request a multi-gigabyte allocation and repeated calls cannot accumulate leaked memory (side effect: caps large legitimate volumes); and run the image-processing worker under a strict memory cgroup/ulimit with automatic restart so a leak is contained and self-healing rather than fatal to the host (side effect: dropped in-flight jobs on restart).