CVE-2026-47667

Name of the Vulnerable Software and Affected Versions CImg Library versions prior to 4.0.0

Description In the load analyze() function, the header size field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and used to allocate a buffer via new unsigned char[header size] without verifying it against the actual file size. If a malformed file causes the subsequent fread() function to return a short value, a CImgIOException is thrown, and the allocated buffer is not freed. This can lead to significant memory leaks, where a small crafted file can trigger an allocation of approximately 1.3 GB per call. This issue is accessible through the load analyze() function and the generic load() function when processing files with .hdr, .img, or .nii extensions.

Recommendations Update to version 4.0.0.