CVE-2026-47667— GreycLab CImg 输入验证错误漏洞

CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

在移除最后引用时对内存的释放不恰当(内存泄露)

GreycLab CImg 输入验证错误漏洞

GreycLab CImg是GreycLab的C++图像处理库。 GreycLab CImg 4.0.0之前版本存在安全漏洞，该漏洞源于_load_analyze()函数中未对从Analyze/NIfTI文件头部读取的header_size字段进行实际文件大小限制，可能导致内存分配过大且无法释放，进而造成拒绝服务。

N/A

N/A