FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field

Summary

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.

Remediation

1. Inventory every fltk fltk deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1
• Advisoryhttps://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow
• Advisoryhttps://www.vulncheck.com/advisories/fltk-through-1.4.5-stack-buffer-overflow-via-fl-bmp-image-colors-used-field
• Referencehttps://github.com/fltk/fltk
• Referencehttps://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L255-L265
• Referencehttps://github.com/fltk/fltk/issues/1632