I found a likely memory-safety issue by static source review (no runtime exploit was developed). Sharing it here so it can be fixed.
Honest severity: High
Full technical write-up (trace, PoC builder, suggested fix):
The write-up gives the exact file and line of the sink, the reachability chain from the public entry point, an honest impact assessment, and a suggested fix. I am happy to send a patch or any further detail.
Reported by HaiND (Nguyen Dinh Hai), Post and Telecommunication Institute of Technology, github.com/Haind03.
ManoloFLTK self-assigned this on Oct 22, 2026
ManoloFLTK added a commit that references this issue on Oct 22, 2026 Fix "BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP… 3a049d8
Fix "BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP…
ManoloFLTK added fixed The issue or PR was fixed. The issue or PR was fixed. Platform: X11 platform specific (Unix/X11)) platform specific (Unix/X11)) Platform: Wayland platform specific (Unix/Wayland) platform specific (Unix/Wayland) Platform: Windows platform specific (Windows) platform specific (Windows) Platform: macOS platform specific (macOS) platform specific (macOS) Prio 3 - Moderate e.g. unable to compile the software e.g. unable to compile the software on Oct 22, 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
