PT-2026-36893 · Cimg · Cimg

Jorgebarredo14 · CVE-2026-42146 · Published 2026-05-04 · Updated 2026-05-04

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CImg Library versions prior to commit c3aacf5

Description An issue exists in the processing of BMP files where the nb colors field from the file header is used to calculate allocation size without validation against the actual remaining file size. A specially crafted BMP file containing a large nb colors value can trigger an out-of-memory condition, leading to a crash of any application utilizing the library to load untrusted BMP files.

Recommendations Update to the version containing commit c3aacf5.

Exploit

Fix

DoS

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-42146

GHSA-G54R-QMGX-C6FV

Affected Products

Cimg

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42146.json · Exploit
• 🔥 https://github.com/GreycLab/CImg/issues/477 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42146 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42146 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42146 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42146 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42146 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42146 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42146 · Security Note
• https://github.com/GreycLab/CImg/commit/c3aacf5b96ac1e54b7af1957c6737dbf3949f6d3 · Note
• https://github.com/GreycLab/CImg/releases/tag/v.3.7.5 · Note
• https://github.com/GreycLab/CImg/security/advisories/GHSA-g54r-qmgx-c6fv · Note
• https://twitter.com/VulmonFeeds/status/2051375494025658503 · Twitter Post
• https://twitter.com/CVEnew/status/2051361249640800424 · Twitter Post