CVE-2026-116724
Description
A flaw was found in FLTK. An attacker could achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to open a specially crafted BMP or ICO image file. Due to an integer overflow when calculating image dimensions, the application allocates an undersized memory buffer and writes data beyond its boundaries, leading to heap memory corruption.
Statement
This vulnerability is rated as an Important severity flaw because successful exploitation could lead to arbitrary code execution within the context of the running application or cause an application crash. In Red Hat Enterprise Linux environments, the FLTK library is used by desktop graphical utilities to render graphical assets. Triggering the flaw requires a user to open an untrusted bitmap or icon file using an application built against the affected toolkit. While exploitation is limited to local user interaction, the potential compromise of confidentiality, integrity, and availability justifies the Important rating.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to cast image dimensions to size_t and validate colormap size bounds prior to heap buffer allocation in Fl_BMP_Image to prevent integer overflows and out-of-bounds writes: upgrade to FLTK 1.5.0 (or the fixed Fltk/Giac builds), which return ERR_FORMAT if colors_used exceeds 256 and cast width to size_t during image array allocation to prevent integer overflow, closing all 2 injection vectors (crafted BMP image file, crafted ICO image file). Until patched, this is a concern on Applications built against FLTK through 1.4.5 handling user-supplied BMP or ICO files, so Prevent users from opening untrusted BMP or ICO files with desktop utilities linked against vulnerable FLTK builds. As a compensating measure, Randomize user-space heap and library memory layout to hinder reliable code execution via heap corruption, Harden executable binaries with full RELRO and PIE to prevent relocation table overwrites during heap exploitation, Restrict indirect call targets using Control Flow Integrity to mitigate hijacked control flow from corrupted function pointers, and Enforce non-executable heap memory pages to block execution of payload code written to the heap buffer. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
