CVE-2026-116724

A flaw was found in FLTK. An attacker could achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to open a specially crafted BMP or ICO image file. Due to an integer overflow when calculating image dimensions, the application allocates an undersized memory buffer and writes data beyond its boundaries, leading to heap memory corruption.

This vulnerability is rated as an Important severity flaw because successful exploitation could lead to arbitrary code execution within the context of the running application or cause an application crash. In Red Hat Enterprise Linux environments, the FLTK library is used by desktop graphical utilities to render graphical assets. Triggering the flaw requires a user to open an untrusted bitmap or icon file using an application built against the affected toolkit. While exploitation is limited to local user interaction, the potential compromise of confidentiality, integrity, and availability justifies the Important rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to cast image dimensions to size_t and validate colormap size bounds prior to heap buffer allocation in Fl_BMP_Image to prevent integer overflows and out-of-bounds writes: upgrade to FLTK 1.5.0 (or the fixed Fltk/Giac builds), which return ERR_FORMAT if colors_used exceeds 256 and cast width to size_t during image array allocation to prevent integer overflow, closing all 2 injection vectors (crafted BMP image file, crafted ICO image file). Until patched, this is a concern on Applications built against FLTK through 1.4.5 handling user-supplied BMP or ICO files, so Prevent users from opening untrusted BMP or ICO files with desktop utilities linked against vulnerable FLTK builds. As a compensating measure, Randomize user-space heap and library memory layout to hinder reliable code execution via heap corruption, Harden executable binaries with full RELRO and PIE to prevent relocation table overwrites during heap exploitation, Restrict indirect call targets using Control Flow Integrity to mitigate hijacked control flow from corrupted function pointers, and Enforce non-executable heap memory pages to block execution of payload code written to the heap buffer. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)