CImg EUVD-2026-110833

Exploitation requires an application that uses CImg 4.0.6 or earlier and invokes its BMP loader (_load_bmp / load_bmp) on an attacker-controlled file; the specific trigger is a BMP whose header width field is large enough to overflow the dx_bytes row byte-count computation. Limiting factors: this is a local/file-processing vector (AV:L) requiring the victim or victim application to load the crafted BMP (UI:P) - there is no direct remote network trigger unless a higher-level product exposes BMP decoding to untrusted input; no authentication is involved (PR:N); and impact is confined to a crash or heap-memory disclosure into the decoded image (no integrity change or code execution is indicated). Products that never pass untrusted BMP data to CImg are not realistically exposed.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9 Medium) is consistent with the description: this is a file-parsing flaw in a library, so the 'local' attack vector reflects that a victim application must process an attacker-supplied BMP rather than the attacker reaching a network service directly, and UI:P reflects that passive user/application action (loading the file) is required. Impact is weighted toward availability (VA:H, process crash from the heap out-of-bounds read) with limited confidentiality (VC:L, adjacent heap bytes disclosed into the decoded image); there is no integrity or code-execution claim. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no quantitative or confirmed signal of in-the-wild exploitation; the vendor-ecosystem decision label is 'this_month' (notably not 'act_now' or 'emergency'), which aligns with a patch-in-routine-cycle urgency. The main caveat: EPSS is missing and PoC status is not explicitly confirmed, so exploitation likelihood is inferred from the mechanism and the public VulnCheck advisory rather than measured - treat the risk as real-but-bounded and prioritize patching for any product that ingests untrusted BMP files through CImg.

An attacker crafts a BMP file whose header width is large enough that the row byte-count calculation (dx_bytes) integer-overflows and wraps, undersizing the pixel buffer. When a victim application built on CImg 4.0.6 or earlier decodes that file via _load_bmp(), the decoder reads past the allocated heap buffer, crashing the process or copying adjacent heap memory into the decoded image and disclosing it. No confirmed working exploit is published, though the flaw is documented in the vendor issue tracker and a VulnCheck advisory, and the local/UI-required vector means the victim must be induced to load the malicious image.