The CImg Library before version 4.0.0 has a vulnerability (CVE-2026-47667) in the _load_analyze() function where the header_size field from an Analyze/NIfTI file is read as an unsigned int and used directly to allocate memory without validating it against the actual file size. If fread returns fewer bytes than expected due to a malformed file, the function throws an exception but does not free the allocated buffer, causing a memory leak. A crafted 6-byte file can trigger an allocation of approximately 1.3 GB per call, leaking memory on every error path. This affects the load_analyze() and generic load() functions for files with .hdr, .img, or .nii extensions. The vulnerability is fixed in version 4.0.0.

This vulnerability can cause a denial of service by exhausting system memory through repeated memory leaks triggered by malformed input files. There is no impact on confidentiality or integrity reported. The CVSS score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Upgrade to CImg version 4.0.0 or later, where this issue is fixed. There is no official patch advisory beyond this version update. Until upgraded, avoid processing untrusted Analyze/NIfTI files with extensions .hdr, .img, or .nii to prevent triggering the memory leak.