Skip to content
FLTK BMP Image Loader Vulnerabilities Disclosed

FLTK BMP Image Loader Vulnerabilities Disclosed

First seen 27 Oct 2026, 02:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 06:43 UTC
  • •Two critical vulnerabilities in FLTK BMP image loader allow for buffer overflows.
  • •CVE-2026-116723 and CVE-2026-116724 have a CVSS score of 8.5, classified as high severity.
  • •A patch was released before public disclosure, mitigating immediate risks.

Two memory-safety vulnerabilities, CVE-2026-116723 and CVE-2026-116724, were disclosed in the FLTK BMP image loader affecting release-1.4.5 and earlier. The vulnerabilities allow for stack and heap buffer overflows via crafted BMP files, enabling attackers to control memory beyond the intended limits. The issues were reported by Nguyen Dinh Hai from the Post and Telecommunication Institute of Technology. Affected systems include various platforms using FLTK, including Unix/X11, Wayland, Windows, and macOS. The vulnerabilities were confirmed on the master branch and have a CVSS score of 8.5, indicating high severity. A patch was released on October 22, 2026, prior to the public disclosure on October 26, 2026. No has been reported as of now.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2021-03-12
CVE-2021-28306 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
Patch released for FLTK vulnerabilities
A patch was committed to address the stack and heap buffer overflow vulnerabilities in the BMP image loader.
Article 2
2026-10-26
CVE-2026-116723 and CVE-2026-116724 published
The vulnerabilities were officially published with a CVSS score of 8.5, indicating high severity.
Article 1

More articles in this cluster (2)

Following this threat?

Track CVE-2021-28306 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 3

Common questions

Which versions of FLTK are affected?
FLTK release-1.4.5 and all earlier versions are affected by these vulnerabilities.
What is the severity of these vulnerabilities?
Both CVE-2026-116723 and CVE-2026-116724 have a CVSS score of 8.5, indicating high severity.
Is there a patch available?
Yes, a patch was released on October 22, 2026, prior to the public disclosure of the vulnerabilities.