FLTK EUVD-2026-110505

Exploitation requires that an application uses FLTK's BMP/ICO image loading (Fl_BMP_Image::load_bmp_()) and that a user opens or renders an attacker-supplied crafted BMP or ICO file whose declared width and height are large enough that the product of width*height*dstBDepth overflows during the pixel-buffer allocation. No authentication or prior privileges are needed (PR:N), but exploitation is gated by two limiting factors: the local attack vector (AV:L) means the malicious file must be delivered to and processed on the target host, and user interaction is required (UI:P) - the victim must open/view the file. There is no remote, interaction-free path. Affected: all FLTK versions through 1.4.5; the fix adds a size_t cast and a colors_used>256 format check.

Signals diverge sharply. The input CVSS 4.0 score of 8.5 is driven by high technical impact (VC:H/VI:H/VA:H - heap corruption potentially leading to arbitrary code execution) combined with no privilege requirement (PR:N). However, the vector is local (AV:L) and requires user interaction (UI:P), meaning a victim must open an attacker-supplied file - this is not remotely automatable mass exploitation. The exploitation-probability signals are low and consistent with each other: EPSS is 0.15% (4th percentile), there is no CISA KEV listing (not confirmed actively exploited), and the vuln.today Decision label is 'this_week' rather than act_now/emergency. The low EPSS alongside no KEV indicates this is not currently seeing widespread exploitation. Net: a genuinely serious memory-safety flaw with real code-execution potential, but real-world urgency is tempered by the local+user-interaction requirement and the absence of exploitation evidence. Treat as a patch-this-week item per the Decision label, not an emergency. No conflicting signals in the raw data; the main caveat is that the 'local' classification reflects the need to deliver and open a file rather than any requirement for prior host access.

An attacker crafts a BMP or ICO file whose header declares very large width and height values and distributes it (email attachment, download, web content). When a victim opens or renders the file in any application built on FLTK ≤1.4.5, the integer overflow in Fl_BMP_Image::load_bmp_() produces an undersized heap allocation and subsequent row decoding writes file-derived data past the buffer, corrupting the heap and potentially leading to code execution. A public technical write-up describing the overflow exists, though it is not verified as working exploit code.