{"id":"CVE-2026-47667","summary":"CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header","details":"CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short`  as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.","aliases":["GHSA-rmfc-grgj-qwhv"],"modified":"2026-07-25T08:07:48.054747Z","published":"2026-07-21T19:57:49.446Z","database_specific":{"cwe_ids":["CWE-1284","CWE-401","CWE-789"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47667.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47667.json"},{"type":"ADVISORY","url":"https://github.com/GreycLab/CImg/security/advisories/GHSA-rmfc-grgj-qwhv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47667"},{"type":"REPORT","url":"https://github.com/GreycLab/CImg/issues/480"},{"type":"FIX","url":"https://github.com/GreycLab/CImg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/greyclab/cimg","events":[{"introduced":"0"},{"fixed":"6a69bf725ffd111a4c7dc61cc15e3661abd158ee"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.0.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v.3.7.6","v.3.7.5","v.3.7.4","v.3.7.3","v.3.7.2","v.3.7.1","v.3.7.0","v.3.6.6","v.3.6.5","v.3.6.4","v.3.6.3","v.3.6.2","v.3.6.1","v.3.6.0","v.3.5.5","v.3.5.4","v.3.5.3","v.3.5.2","v.3.5.1","v.3.5.0","v.3.4.3","v.3.4.2","v.3.4.1","v.3.4.0","v.3.3.6","v.3.3.5","v.3.3.4","v.3.3.3","v.3.3.2","v.3.3.1","v.3.3.0","v.3.2.6","v.3.2.5","v.3.2.4","v.3.2.3","v.3.2.2","v.3.2.1","v.3.2.0","v.3.1.6","v.3.1.4","v.3.1.3","v.3.1.2","v.3.1.1","v.3.1.0","v.2.9.0","v.2.8.4","v.2.8.3","v.2.8.2","v.2.8.1","v.2.8.0","v.2.7.5","v.2.7.4","v.2.7.3","v.2.7.2","v.2.7.1","v.2.7.0","v.2.6.7","v.2.6.6","v.2.6.5","v.2.6.4","v.2.6.3","v.2.6.2","v.2.6.1","v.2.6.0","v.2.5.7","v.2.5.6","v.2.5.5","v.2.5.4","v.2.5.3","v.2.5.2","v.2.5.1","v.2.5.0","v.2.4.5","v.2.4.4","v.2.4.3","v.2.4.2","v.2.4.1","v.2.4.0","v.2.3.6","v.2.3.5","v.2.3.4","v.2.3.3","v.2.3.2","v.2.3.1","v.2.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47667.json","vanir_signatures_modified":"2026-07-25T08:07:48Z","vanir_signatures":[{"source":"https://github.com/greyclab/cimg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee","target":{"file":"CImg.h","function":"mirror"},"deprecated":false,"digest":{"function_hash":"64850874204790192369442882065534401051","length":2440},"id":"CVE-2026-47667-455ea9a9","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-47667-7562b281","signature_type":"Line","signature_version":"v1","source":"https://github.com/greyclab/cimg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee","target":{"file":"CImg.h"},"deprecated":false,"digest":{"line_hashes":["274020267193505580581467988149926798335","267751388851782724500441606606447005431","154320843425205889703892376995217000546","60003959896899099543604955612120252912","227262154626103917204001404682565335643","20202843776292679775849380636221541454","208375688493944476329691078324955799459","76665352839007682594423792542238802180","51227753870438853288228584047505202079","318807377493964779603932286459272862775","99568097309481904575593460034085769693","202212650195587275686261804826579323283","160804050586482798084636952638106686961","290485889294633235872856087330691952652","337214017823461270401062215472367196884","73078775220989288858292645519987234158","210549598161666680598913620885704133498","217012288743673439611254986275219102030","281646402086819358824349887694534037727","283319047245445200561511929965206244314","276892079898023565988456616329822776414","262458565895144925296215434784977583326","174140394130339996980094263633210231233","66360674633284014630610722134141611196","80923641675931460038101136056292648321","94370278428037681048197307040862641251","251643283392259508968078487326100178797","247636276697896097015072821247031515304","204818801362048642413966534462002032505","142866878313662837380204553568256736021","100628995266845577368385322350176230484","253789066051184758615679357539161694311","65090641131489658606380769805746138954","103007064719802614253016410791581637782","180818637714422137013505728746117473735","239381699422001646707194528311877110410","102539103894640867528842761670763409421","39054380622098359454874035532872981290","7338929501810950970822990696280195155","169218165237212922558660916057547250515","215524263912215046668644484768242866380","258105777126831581868098564596898529034","218335407094427175374720904889630025636","182071155205439406113496487024764411255","206680542065068534698778374313054034944","180149645501785271156459340098008020681","207111437411996693950240667576395764784","87018113963550571134107870169776605590","238698252237338487458424991343980462411","280203118421768413771980779020331083431","162492940976985373147548216961457853119","85349385016140053365402127845630029960","129021872205385890922317303391951386626","15081979507000811038919057629397510951","227470244187363800825154093662610056512","277894978435168176104576493346786658303","152933517146650371031297934395923786366","142482457974201951178046179130442417687","297489102137277621196574467402726315229","226417666159024352398601613972211981790","225794406073886918989188459863455706946","130290886912021204823525098061321179552","340240883962543758408246425990493641505","113647234779460409432461708392208255606","200881646975782166563084379675806944726","152469678388317094615800967724472811528","284802028716319401575416211014896605463","59611852894977965347354108884904072594","202665748245406676401097333661636400972","208476368964769878412415716257292607960","75963027596175498210408665525379586065","158846335000709170387204596998640851798","152469678388317094615800967724472811528","284802028716319401575416211014896605463","43458093944944133188919867958555038726","173372517903717748307148791747092827784","92317184737974539965858424575171202250","276058746700467787897504365398771074288","201174650387581253673830381603316404675","152469678388317094615800967724472811528","284802028716319401575416211014896605463","32966319381461830666390421436523243789","97700682005584641000074428114629697965","184169116874245682349561474933511942152","76184148152683236096179002900348051907","306318635899247215859373319939967398677","152469678388317094615800967724472811528","284802028716319401575416211014896605463","180244769870248646854720698698302135980","124974023940695174898738004246862096660","23300437707437117438514678414814934194","191034983677185982630179566042112768047","189216459028872028885184996174898760575","230188782949416317798653270541969869634","130471414512388951445000756602236218695","48624429411112752114399851392863720262","32762956115820183619242038652678564820","225376028275631867040911020812820922731","26589407861144665166536800812115078088","339971123354442046111219393571653349087","229003164477699458949169340356710916270","130457282750279967669029263267348929490","335848747396171227476234299544945624166","26619422164313123018825791714934102100","19479365711616780210625283720012484165","141508582462005156514226390462857591033","75324747434604077117241880277818283676","312619689556133737549250701075408811832","23300437707437117438514678414814934194","191034983677185982630179566042112768047","130457282750279967669029263267348929490","335848747396171227476234299544945624166","49432858828618038874538860546682154808","170305950334541968209961180404496949164","203195839286591828421290412770106300218","193313443228333695875507566572787488677","23300437707437117438514678414814934194","191034983677185982630179566042112768047","130457282750279967669029263267348929490","166055698203017147166007839711484076529","331461324125096856518692296651197080002","51693062593639608490979982197579011302","159705038675755244855922293326757030477","159342821401504615309437068341028299086","339624302600517131857721693891834849791","339971123354442046111219393571653349087","229003164477699458949169340356710916270","130457282750279967669029263267348929490","335848747396171227476234299544945624166","166125662690101783010326471271746461059","312702998289230772521833276523117488882","297332878988019110751764534284843751898","282100142974351272373191885053495741260","312619689556133737549250701075408811832","23300437707437117438514678414814934194","191034983677185982630179566042112768047","130457282750279967669029263267348929490","335848747396171227476234299544945624166","49432858828618038874538860546682154808","170305950334541968209961180404496949164","203195839286591828421290412770106300218","193313443228333695875507566572787488677","23300437707437117438514678414814934194","191034983677185982630179566042112768047","130457282750279967669029263267348929490","166055698203017147166007839711484076529","331461324125096856518692296651197080002","51693062593639608490979982197579011302","309662926636443450318258095347076246461","305801088140654631178390781174480412028","339642183966817613050724102155765268346","339971123354442046111219393571653349087","229003164477699458949169340356710916270","130457282750279967669029263267348929490","335848747396171227476234299544945624166","1833826253081864931305609866982449031","241742246494507841504403825130258523015","173383997898502019591461084145922659061","138526813133405142411163182049331825247","312619689556133737549250701075408811832","23300437707437117438514678414814934194","191034983677185982630179566042112768047","130457282750279967669029263267348929490","335848747396171227476234299544945624166","49432858828618038874538860546682154808","170305950334541968209961180404496949164","203195839286591828421290412770106300218","193313443228333695875507566572787488677","23300437707437117438514678414814934194","191034983677185982630179566042112768047","130457282750279967669029263267348929490","166055698203017147166007839711484076529","331461324125096856518692296651197080002","51693062593639608490979982197579011302","47429685708037390115425557608850155690","173487502424920730359531222639971794748","16448521672316629965893283264953847471","258704901117903160367580038481749258259","113780616308993151159483815365932090726","147604810899562084217595389968098265226","190875074714489531315164070549937504139","233137714340381487541974596257432136581","23155821015627555543790306064437577756","296128950109449999106244473995019736371","54701755324499573579392362213081518516","194528482378735353745393440800800143053","58361651507546973282984061749190815494","7406878568158628126032797725262702307","339340119334848869720804696205751685292","216643868188256753841853715034026266925","163809952857316349092987006763424453068","312865455108440880584372432750177429307","62057324198440747369237248526797877971","132386629705621299051463875724356550940","6306690422031777179876319749498538888","7406878568158628126032797725262702307","268565512927915433767349228531301881967","310839752171091901214675309836743913068","269231812941312908937744841904151045218","249836728877440686199745438445423981150","123681673961905714899659555650133821963","58921908067912854575399133122650128163","45868132961894616210439013535844603760","91599781753561656277824983469896722951","50220212048814540606699754015365684435","1554005784721617723797351634312085763","213969571579393238314477327370348383088","61644775979964567006772848177118136276","296185326630894691657985632415823889243","7541714447317575698750742808225421036","198827069660281505805346300894419301033","16788260984529616088367956165196062661","87396506893789120507474274095158402482","139208359139899801077187811345817206809","148998891305505405100388759809537298317","206544384194696470608106008152351082973","6957979670063667584987295890488739490","222428755236218788859638644333355964920","1889176877705851341614379697893751298","10073773428607971909582666780388652098","218120833813721732102850348479720822580"],"threshold":0.9}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}