PT-2026-62078 · Greyclab · Cimg

CVE-2026-47667 · Published 2026-07-21 · Updated 2026-07-21

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in load analyze(), the header size field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned char[header size] without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent fread returns short as it will for any malformed file), the function throws a CImgIOException and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via load analyze() and the generic load() when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

Fix

Memory Leak

Weakness Enumeration

CWE-789

CWE-401

CWE-1284

Related Identifiers

CVE-2026-47667

Affected Products

Cimg

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-47667 · Security Note
• https://github.com/GreycLab/CImg/security/advisories/GHSA-rmfc-grgj-qwhv · Note
• https://github.com/GreycLab/CImg/issues/480 · Note
• https://github.com/GreycLab/CImg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee · Note