CVE-2026-116723

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl BMP Image::load bmp () that allows attackers to corrupt stack memory by supplying an oversized BMP colors used field. Attackers can craft BMP or ICO files with colors used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.