FLTK EUVD-2026-110504

Exploitation requires that a victim open or process an attacker-crafted BMP or ICO file through an application that uses FLTK's (≤1.4.5) image loading via Fl_BMP_Image::load_bmp_(). The specific trigger stated in the evidence is a colors_used field set above 256, which causes the colormap data to overflow the fixed 768-byte stack array. Limiting factors that reduce real-world risk: the vector is local (AV:L) and requires user interaction to open/render the malicious file (UI:P), no authentication is needed (PR:N), and the target application must actually invoke FLTK's BMP/ICO decoder. There is no remote, zero-click, or service-side exposure described in the sources.

Signals point to a moderate, patch-this-week priority rather than an emergency. The CVSS 4.0 base score of 8.5 is high, but the vector itself tempers that: AV:L with UI:P means this is not remote unauthenticated exploitation - a victim must locally open or process an attacker-supplied BMP/ICO file in an application that uses FLTK's image loader. Exploitation probability signals are low and consistent with each other: EPSS is 0.16% (5th percentile) and the CVE is not listed in CISA KEV, so there is no public active-exploitation evidence. A public PoC reference exists (a hackmd technical write-up and a VulnCheck advisory); it is not verified as working exploit code, and PoC availability must not be conflated with active exploitation. VI/VC/VA:H reflect potential code execution, but the dominant realistic outcome of a stack smash in an image parser is a crash (denial of service), with code execution being conditional on exploit development and mitigations present on the target. The vuln.today Decision label is this_week, so the appropriate action is to apply the vendor fix promptly, not to treat it as an active-exploitation fire drill. No signals are strongly conflicting; the main caveat is that severity is driven by theoretical RCE impact while the practical risk is bounded by the requirement for local file processing and the low EPSS.

An attacker crafts a BMP or ICO file whose colors_used field is set above 256 and delivers it to a victim (e.g., via download, email attachment, or a shared directory). When the victim opens or previews the file in an application built on FLTK through 1.4.5, Fl_BMP_Image::load_bmp_() writes the oversized colormap past the fixed 768-byte stack array, corrupting stack memory and causing a crash or potential code execution. A public technical write-up exists describing the overflow, but it is not verified as a working weaponized exploit; the local vector (AV:L) and required user interaction (UI:P) mean the attacker depends on the victim processing the malicious file.