CVE-2026-42144

{
  "id": "CVE-2026-42144",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-04T18:16:31.830",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CImg Library is a C++ library for image processing. Prior to commit 4ca26bc, there is an integer overflow vulnerability in the W*H*D size computation inside _load_pnm() that can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow. Any application using CImg to load untrusted image files is affected. This issue has been patched via commit 4ca26bc."
    },
    {
      "lang": "es",
      "value": "Biblioteca CImg es una biblioteca de C++ para procesamiento de imágenes. Antes del commit 4ca26bc, existe una vulnerabilidad de desbordamiento de entero en el cálculo del tamaño WHD dentro de _load_pnm() que puede eludir la protección de asignación de memoria. Un archivo PNM/PGM/PPM manipulado con valores de dimensión grandes provoca que el desbordamiento se ajuste, asignando un búfer de tamaño insuficiente y potencialmente desencadenando un desbordamiento de búfer en el heap. Cualquier aplicación que utilice CImg para cargar archivos de imagen no confiables se ve afectada. Este problema ha sido parcheado mediante el commit 4ca26bc."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GreycLab",
          "product": "CImg",
          "versions": [
            {
              "version": "< 4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-05T13:07:54.801471Z",
          "id": "CVE-2026-42144",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/GreycLab/CImg/issues/478",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/GreycLab/CImg/releases/tag/v.3.7.5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc",
      "source": "[email protected]"
    }
  ]
}