CVE-2026-47667: CWE-401: Missing Release of Memory after Effective Lifetime in GreycLab CImg
CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.
AI Analysis
Technical Summary
The CImg Library, a C++ image processing library, has a vulnerability (CVE-2026-47667) in versions before 4.0.0 where the _load_analyze() function reads the header_size field from an Analyze/NIfTI file without validating it against the actual file size. This unbounded allocation can be up to approximately 4 GB. If fread returns fewer bytes than expected (due to a malformed file), the function throws an exception but does not free the allocated memory, causing a memory leak. This vulnerability is triggered via load_analyze() and the generic load() functions when processing .hdr, .img, or .nii files. The issue is fixed in version 4.0.0.
Potential Impact
An attacker can cause the application using vulnerable CImg versions to allocate large amounts of memory that are never freed, leading to denial of service through memory exhaustion. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade to CImg version 4.0.0 or later, where this issue is fixed. Since no official patch or temporary fix is indicated other than upgrading, users should update to the fixed version to remediate this vulnerability.
CVE-2026-47667: CWE-401: Missing Release of Memory after Effective Lifetime in GreycLab CImg
Description
CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.
CVSS v3.1
Score 7.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The CImg Library, a C++ image processing library, has a vulnerability (CVE-2026-47667) in versions before 4.0.0 where the _load_analyze() function reads the header_size field from an Analyze/NIfTI file without validating it against the actual file size. This unbounded allocation can be up to approximately 4 GB. If fread returns fewer bytes than expected (due to a malformed file), the function throws an exception but does not free the allocated memory, causing a memory leak. This vulnerability is triggered via load_analyze() and the generic load() functions when processing .hdr, .img, or .nii files. The issue is fixed in version 4.0.0.
Potential Impact
An attacker can cause the application using vulnerable CImg versions to allocate large amounts of memory that are never freed, leading to denial of service through memory exhaustion. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade to CImg version 4.0.0 or later, where this issue is fixed. Since no official patch or temporary fix is indicated other than upgrading, users should update to the fixed version to remediate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-19T21:10:38.797Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5fd4a41010f89cc224946f
Added to database: 07/21/2026, 20:20:52 UTC
Last enriched: 07/21/2026, 20:35:28 UTC
Last updated: 07/21/2026, 21:48:30 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.