CVE-2026-116723

A flaw was found in FLTK. This vulnerability allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to open a specially crafted BMP or ICO image file. The issue occurs due to a stack-based buffer overflow when parsing image headers with an oversized color palette field, leading to memory corruption.

Red Hat has rated this vulnerability as having an Important severity because successful exploitation could permit arbitrary code execution with the privileges of the local user running the vulnerable application, even though triggering the flaw requires user interaction to open an untrusted image. FLTK is distributed as an optional graphical user interface development toolkit rather than a core system service or network-facing daemon, limiting the attack surface to client-side applications that directly parse unvalidated bitmap or icon files. Headless installations and standard server deployments that do not run FLTK-linked software are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to validate the colors_used header field against the fixed 256-entry colormap array boundary in Fl_BMP_Image::load_bmp_() before reading palette data: upgrade to FLTK 1.5.0 (or the fixed Fltk/Giac builds), which reject files specifying a colors_used value greater than 256 with an ERR_FORMAT error and cast width to size_t during pixel array allocation, closing all 2 injection vectors (crafted BMP image file, crafted ICO image file). Until patched, this is only a concern on Client applications linked against FLTK parsing untrusted image files — Headless installations and server deployments not running FLTK-linked software are unaffected — so Prevent users and services from opening or processing untrusted BMP or ICO image files within FLTK-linked applications. As a compensating measure, Enable Address Space Layout Randomization to randomize stack and library addresses and disrupt payload construction, Enable Full RELRO and PIE to randomize base executable addresses and harden the Global Offset Table, Enforce Control Flow Integrity and shadow call stacks to protect return addresses and validate indirect branches, Compile with FORTIFY_SOURCE to substitute bounds-checked functions that abort when writes exceed fixed buffer bounds, and Enforce non-executable stack memory via NX/XD bits to prevent direct execution of injected shellcode. These controls limit blast radius and contain exploitation, but they do not fix the underlying stack-based buffer overflow — apply the upstream patch to fully remediate.

Highest-impact CME: CME-103 Stack Canaries (Stack Protector) (high)