PT-2026-36892 · Unknown · Cimg Library

Jorgebarredo14 · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-42144

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions CImg Library versions prior to commit 4ca26bc

Description An integer overflow exists in the load pnm() function during the computation of WHD size. A specially crafted PNM, PGM, or PPM file containing large dimension values can cause the calculation to wrap around, bypassing the memory allocation guard. This results in the allocation of an undersized buffer, which may lead to a heap buffer overflow when processing untrusted image files.

Recommendations Update CImg Library to the version containing commit 4ca26bc.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-42144

Affected Products

Cimg Library

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-42144 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-42144 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42144 · Security Note
• https://ubuntu.com/security/CVE-2026-42144 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42144 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42144 · Vendor Advisory
• https://github.com/GreycLab/CImg/issues/478 · Note
• https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc · Note
• https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d · Note
• https://github.com/GreycLab/CImg/releases/tag/v.3.7.5 · Note
• https://twitter.com/VulmonFeeds/status/2051378053767483688 · Twitter Post
• https://twitter.com/CVEnew/status/2051361250789974162 · Twitter Post