CVE-2026-117555
CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in t
CVSS
6.1
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 27, 2026 · Last modified: Oct 27, 2026 · CWE-190
Not enough EPSS history yet.
CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.
- github.comhttps://github.com/GreycLab/CImg
- github.comhttps://github.com/GreycLab/CImg/blob/v.4.0.6/CImg.h#L55659
- github.comhttps://github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5
- github.comhttps://github.com/GreycLab/CImg/issues/495
- www.vulncheck.comhttps://www.vulncheck.com/advisories/greyclab-cimg-through-4.0.6-heap-out-of-bounds-read-via-integer-overflow-in-load-bmp
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1145968.2 HIG—
———In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.2hCVE-2026-1145959.8 CRI—
———In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.2hCVE-2026-93866——
———An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.3hCVE-2026-1115858.8 HIG—
———An integer overflow in the remote-control
screen processing component of TeamViewer clients (Full Client, Portable and Remote
Control App) prior to version 15.83 may allow a malicious remote host to cause
a denial of service or, depending on the platform, potentially execute
arbitrary code with the privileges of the viewer process. Exploitation requires
a user to establish a remote-control session to an attacker-controlled or
compromised host.3hCVE-2026-1168406.1 MED—
——0llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.3hCVE-2026-1168296.6 MED—
——0llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.3h