Threats tagged 'ghsa-vc45-5x28-58gf'

FLTK versions through 1.4.5 have an integer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw causes an undersized pixel buffer allocation based on file-supplied width and height values. An attacker can craft a BMP or ICO file with large dimensions that triggers a heap buffer overflow during row decoding, leading to heap corruption.