CVE-2026-47667

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47667
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47667.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47667
Aliases
  • GHSA-rmfc-grgj-qwhv
Downstream
Published
2026-07-21T19:57:49.446Z
Modified
2026-07-25T08:07:48.054747Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header
Details

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in _load_analyze(), the header_size field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned char[header_size] without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent fread returns short as it will for any malformed file), the function throws a CImgIOException and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via load_analyze() and the generic load() when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47667.json",
    "cwe_ids": [
        "CWE-1284",
        "CWE-401",
        "CWE-789"
    ]
}
References

Affected packages

Git / github.com/greyclab/cimg

Affected ranges

Type
GIT
Repo
https://github.com/greyclab/cimg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6a69bf725ffd111a4c7dc61cc15e3661abd158ee
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.0.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v.*
v.2.3.0
v.2.3.1
v.2.3.2
v.2.3.3
v.2.3.4
v.2.3.5
v.2.3.6
v.2.4.0
v.2.4.1
v.2.4.2
v.2.4.3
v.2.4.4
v.2.4.5
v.2.5.0
v.2.5.1
v.2.5.2
v.2.5.3
v.2.5.4
v.2.5.5
v.2.5.6
v.2.5.7
v.2.6.0
v.2.6.1
v.2.6.2
v.2.6.3
v.2.6.4
v.2.6.5
v.2.6.6
v.2.6.7
v.2.7.0
v.2.7.1
v.2.7.2
v.2.7.3
v.2.7.4
v.2.7.5
v.2.8.0
v.2.8.1
v.2.8.2
v.2.8.3
v.2.8.4
v.2.9.0
v.3.1.0
v.3.1.1
v.3.1.2
v.3.1.3
v.3.1.4
v.3.1.6
v.3.2.0
v.3.2.1
v.3.2.2
v.3.2.3
v.3.2.4
v.3.2.5
v.3.2.6
v.3.3.0
v.3.3.1
v.3.3.2
v.3.3.3
v.3.3.4
v.3.3.5
v.3.3.6
v.3.4.0
v.3.4.1
v.3.4.2
v.3.4.3
v.3.5.0
v.3.5.1
v.3.5.2
v.3.5.3
v.3.5.4
v.3.5.5
v.3.6.0
v.3.6.1
v.3.6.2
v.3.6.3
v.3.6.4
v.3.6.5
v.3.6.6
v.3.7.0
v.3.7.1
v.3.7.2
v.3.7.3
v.3.7.4
v.3.7.5
v.3.7.6

Database specific

vanir_signatures_modified 
"2026-07-25T08:07:48Z"
vanir_signatures 
[
    {
        "target": {
            "function": "mirror",
            "file": "CImg.h"
        },
        "id": "CVE-2026-47667-455ea9a9",
        "digest": {
            "function_hash": "64850874204790192369442882065534401051",
            "length": 2440.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/greyclab/cimg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee"
    },
    {
        "target": {
            "file": "CImg.h"
        },
        "id": "CVE-2026-47667-7562b281",
        "digest": {
            "line_hashes": [
                "274020267193505580581467988149926798335",
                "267751388851782724500441606606447005431",
                "154320843425205889703892376995217000546",
                "60003959896899099543604955612120252912",
                "227262154626103917204001404682565335643",
                "20202843776292679775849380636221541454",
                "208375688493944476329691078324955799459",
                "76665352839007682594423792542238802180",
                "51227753870438853288228584047505202079",
                "318807377493964779603932286459272862775",
                "99568097309481904575593460034085769693",
                "202212650195587275686261804826579323283",
                "160804050586482798084636952638106686961",
                "290485889294633235872856087330691952652",
                "337214017823461270401062215472367196884",
                "73078775220989288858292645519987234158",
                "210549598161666680598913620885704133498",
                "217012288743673439611254986275219102030",
                "281646402086819358824349887694534037727",
                "283319047245445200561511929965206244314",
                "276892079898023565988456616329822776414",
                "262458565895144925296215434784977583326",
                "174140394130339996980094263633210231233",
                "66360674633284014630610722134141611196",
                "80923641675931460038101136056292648321",
                "94370278428037681048197307040862641251",
                "251643283392259508968078487326100178797",
                "247636276697896097015072821247031515304",
                "204818801362048642413966534462002032505",
                "142866878313662837380204553568256736021",
                "100628995266845577368385322350176230484",
                "253789066051184758615679357539161694311",
                "65090641131489658606380769805746138954",
                "103007064719802614253016410791581637782",
                "180818637714422137013505728746117473735",
                "239381699422001646707194528311877110410",
                "102539103894640867528842761670763409421",
                "39054380622098359454874035532872981290",
                "7338929501810950970822990696280195155",
                "169218165237212922558660916057547250515",
                "215524263912215046668644484768242866380",
                "258105777126831581868098564596898529034",
                "218335407094427175374720904889630025636",
                "182071155205439406113496487024764411255",
                "206680542065068534698778374313054034944",
                "180149645501785271156459340098008020681",
                "207111437411996693950240667576395764784",
                "87018113963550571134107870169776605590",
                "238698252237338487458424991343980462411",
                "280203118421768413771980779020331083431",
                "162492940976985373147548216961457853119",
                "85349385016140053365402127845630029960",
                "129021872205385890922317303391951386626",
                "15081979507000811038919057629397510951",
                "227470244187363800825154093662610056512",
                "277894978435168176104576493346786658303",
                "152933517146650371031297934395923786366",
                "142482457974201951178046179130442417687",
                "297489102137277621196574467402726315229",
                "226417666159024352398601613972211981790",
                "225794406073886918989188459863455706946",
                "130290886912021204823525098061321179552",
                "340240883962543758408246425990493641505",
                "113647234779460409432461708392208255606",
                "200881646975782166563084379675806944726",
                "152469678388317094615800967724472811528",
                "284802028716319401575416211014896605463",
                "59611852894977965347354108884904072594",
                "202665748245406676401097333661636400972",
                "208476368964769878412415716257292607960",
                "75963027596175498210408665525379586065",
                "158846335000709170387204596998640851798",
                "152469678388317094615800967724472811528",
                "284802028716319401575416211014896605463",
                "43458093944944133188919867958555038726",
                "173372517903717748307148791747092827784",
                "92317184737974539965858424575171202250",
                "276058746700467787897504365398771074288",
                "201174650387581253673830381603316404675",
                "152469678388317094615800967724472811528",
                "284802028716319401575416211014896605463",
                "32966319381461830666390421436523243789",
                "97700682005584641000074428114629697965",
                "184169116874245682349561474933511942152",
                "76184148152683236096179002900348051907",
                "306318635899247215859373319939967398677",
                "152469678388317094615800967724472811528",
                "284802028716319401575416211014896605463",
                "180244769870248646854720698698302135980",
                "124974023940695174898738004246862096660",
                "23300437707437117438514678414814934194",
                "191034983677185982630179566042112768047",
                "189216459028872028885184996174898760575",
                "230188782949416317798653270541969869634",
                "130471414512388951445000756602236218695",
                "48624429411112752114399851392863720262",
                "32762956115820183619242038652678564820",
                "225376028275631867040911020812820922731",
                "26589407861144665166536800812115078088",
                "339971123354442046111219393571653349087",
                "229003164477699458949169340356710916270",
                "130457282750279967669029263267348929490",
                "335848747396171227476234299544945624166",
                "26619422164313123018825791714934102100",
                "19479365711616780210625283720012484165",
                "141508582462005156514226390462857591033",
                "75324747434604077117241880277818283676",
                "312619689556133737549250701075408811832",
                "23300437707437117438514678414814934194",
                "191034983677185982630179566042112768047",
                "130457282750279967669029263267348929490",
                "335848747396171227476234299544945624166",
                "49432858828618038874538860546682154808",
                "170305950334541968209961180404496949164",
                "203195839286591828421290412770106300218",
                "193313443228333695875507566572787488677",
                "23300437707437117438514678414814934194",
                "191034983677185982630179566042112768047",
                "130457282750279967669029263267348929490",
                "166055698203017147166007839711484076529",
                "331461324125096856518692296651197080002",
                "51693062593639608490979982197579011302",
                "159705038675755244855922293326757030477",
                "159342821401504615309437068341028299086",
                "339624302600517131857721693891834849791",
                "339971123354442046111219393571653349087",
                "229003164477699458949169340356710916270",
                "130457282750279967669029263267348929490",
                "335848747396171227476234299544945624166",
                "166125662690101783010326471271746461059",
                "312702998289230772521833276523117488882",
                "297332878988019110751764534284843751898",
                "282100142974351272373191885053495741260",
                "312619689556133737549250701075408811832",
                "23300437707437117438514678414814934194",
                "191034983677185982630179566042112768047",
                "130457282750279967669029263267348929490",
                "335848747396171227476234299544945624166",
                "49432858828618038874538860546682154808",
                "170305950334541968209961180404496949164",
                "203195839286591828421290412770106300218",
                "193313443228333695875507566572787488677",
                "23300437707437117438514678414814934194",
                "191034983677185982630179566042112768047",
                "130457282750279967669029263267348929490",
                "166055698203017147166007839711484076529",
                "331461324125096856518692296651197080002",
                "51693062593639608490979982197579011302",
                "309662926636443450318258095347076246461",
                "305801088140654631178390781174480412028",
                "339642183966817613050724102155765268346",
                "339971123354442046111219393571653349087",
                "229003164477699458949169340356710916270",
                "130457282750279967669029263267348929490",
                "335848747396171227476234299544945624166",
                "1833826253081864931305609866982449031",
                "241742246494507841504403825130258523015",
                "173383997898502019591461084145922659061",
                "138526813133405142411163182049331825247",
                "312619689556133737549250701075408811832",
                "23300437707437117438514678414814934194",
                "191034983677185982630179566042112768047",
                "130457282750279967669029263267348929490",
                "335848747396171227476234299544945624166",
                "49432858828618038874538860546682154808",
                "170305950334541968209961180404496949164",
                "203195839286591828421290412770106300218",
                "193313443228333695875507566572787488677",
                "23300437707437117438514678414814934194",
                "191034983677185982630179566042112768047",
                "130457282750279967669029263267348929490",
                "166055698203017147166007839711484076529",
                "331461324125096856518692296651197080002",
                "51693062593639608490979982197579011302",
                "47429685708037390115425557608850155690",
                "173487502424920730359531222639971794748",
                "16448521672316629965893283264953847471",
                "258704901117903160367580038481749258259",
                "113780616308993151159483815365932090726",
                "147604810899562084217595389968098265226",
                "190875074714489531315164070549937504139",
                "233137714340381487541974596257432136581",
                "23155821015627555543790306064437577756",
                "296128950109449999106244473995019736371",
                "54701755324499573579392362213081518516",
                "194528482378735353745393440800800143053",
                "58361651507546973282984061749190815494",
                "7406878568158628126032797725262702307",
                "339340119334848869720804696205751685292",
                "216643868188256753841853715034026266925",
                "163809952857316349092987006763424453068",
                "312865455108440880584372432750177429307",
                "62057324198440747369237248526797877971",
                "132386629705621299051463875724356550940",
                "6306690422031777179876319749498538888",
                "7406878568158628126032797725262702307",
                "268565512927915433767349228531301881967",
                "310839752171091901214675309836743913068",
                "269231812941312908937744841904151045218",
                "249836728877440686199745438445423981150",
                "123681673961905714899659555650133821963",
                "58921908067912854575399133122650128163",
                "45868132961894616210439013535844603760",
                "91599781753561656277824983469896722951",
                "50220212048814540606699754015365684435",
                "1554005784721617723797351634312085763",
                "213969571579393238314477327370348383088",
                "61644775979964567006772848177118136276",
                "296185326630894691657985632415823889243",
                "7541714447317575698750742808225421036",
                "198827069660281505805346300894419301033",
                "16788260984529616088367956165196062661",
                "87396506893789120507474274095158402482",
                "139208359139899801077187811345817206809",
                "148998891305505405100388759809537298317",
                "206544384194696470608106008152351082973",
                "6957979670063667584987295890488739490",
                "222428755236218788859638644333355964920",
                "1889176877705851341614379697893751298",
                "10073773428607971909582666780388652098",
                "218120833813721732102850348479720822580"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/greyclab/cimg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47667.json"