The vulnerability CVE-2026-42146 in GreycLab's CImg library involves a lack of validation on the nb_colors field read from BMP file headers. This field is used to compute memory allocation size without checking if it exceeds the remaining file size, leading to excessive memory allocation attempts. When a malicious BMP file specifies a large nb_colors value, it can trigger an out-of-memory condition causing the application to crash. This is classified under CWE-789 (Memory Allocation with Excessive Size Value). The vulnerability affects all versions before commit c3aacf5 and has been fixed by adding proper validation in that commit.

Exploitation of this vulnerability results in an out-of-memory condition that crashes applications using vulnerable versions of CImg to load crafted BMP files. There is no indication of confidentiality or integrity impact, only availability is affected due to application crashes. No known exploits have been reported in the wild.

This vulnerability has been patched in commit c3aacf5b96ac1e54b7af1957c6737dbf3949f6d3 of the CImg library. Users should upgrade to this version or later to remediate the issue. Since this is not a cloud service, remediation requires updating the library in affected applications. Patch status is confirmed by the referenced commit. No additional mitigation steps are indicated by the vendor.