CVE-2026-47667

תיאור (מקור, אנגלית)

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

מדדים

CVSS 3.1

7.5 (HIGH) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-1/8/2026

CWE

CWE-401, CWE-789, CWE-1284

קישורים

• https://github.com/GreycLab/CImg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee
• https://github.com/GreycLab/CImg/issues/480
• https://github.com/GreycLab/CImg/security/advisories/GHSA-rmfc-grgj-qwhv
• https://github.com/GreycLab/CImg/issues/480