CVE-2026-47667 Overview
CVE-2026-47667 is a memory leak vulnerability [CWE-401] in the CImg Library, a C++ image processing library maintained by GreycLab. The flaw resides in the _load_analyze() function, which parses Analyze and NIfTI medical imaging files. The function reads a header_size field as an unsigned int from the first 4 bytes of the file and passes it directly to new unsigned char[header_size] without validating it against the actual file size. A malformed 6-byte file forces an allocation of roughly 1.3 GB per call, and the buffer is never freed when the subsequent read fails. The issue affects all versions prior to 4.0.0.
Critical Impact
Attackers can trigger repeated multi-gigabyte heap allocations that are leaked on every error path, exhausting memory and causing denial of service in applications that process untrusted image files.
Affected Products
- CImg Library versions prior to 4.0.0
- Applications using load_analyze() to parse Analyze/NIfTI files
- Applications using the generic load() API with .hdr, .img, or .nii file extensions
Discovery Timeline
- 2026-07-21 - CVE-2026-47667 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-47667
Vulnerability Analysis
The vulnerability exists in the _load_analyze() function used to parse Analyze 7.5 and NIfTI-1 neuroimaging file formats. CImg reads the first 4 bytes of the file as an unsigned 32-bit integer representing the header size. It then passes this attacker-controlled value directly to new unsigned char[header_size], accepting values up to approximately 4 GB. No bounds check compares the requested allocation against the actual file size on disk.
When the subsequent fread call cannot satisfy the read because the file is truncated or malformed, the function throws a CImgIOException. The exception path does not release the previously allocated buffer, resulting in a permanent leak of the entire allocation.
An attacker who submits a crafted 6-byte file with header_size set to a large value can force an allocation of about 1.3 GB. Repeated calls compound the leak until the process runs out of memory.
Root Cause
The root cause is missing input validation combined with unsafe exception handling. The header_size field is trusted without cross-checking it against the file length, and the raw new[] allocation is not wrapped in RAII or a smart pointer. When CImgIOException unwinds the stack, the pointer to the allocated buffer is lost.
Attack Vector
Exploitation requires no authentication and no user interaction beyond passing a malicious file to a vulnerable API. Any service that ingests .hdr, .img, or .nii files from untrusted sources, such as medical imaging web services, DICOM converters, or research pipelines, is reachable over the network. Repeated submissions amplify memory pressure and lead to service crashes.
The vulnerability is limited to availability impact. It does not permit arbitrary code execution or information disclosure.
Detection Methods for CVE-2026-47667
Indicators of Compromise
- Unexpected process memory growth in services that parse Analyze or NIfTI files
- Repeated CImgIOException messages in application logs referencing _load_analyze()
- Inbound uploads of unusually small files with .hdr, .img, or .nii extensions
- Out-of-memory (OOM) kills or crashes of image processing worker processes
Detection Strategies
- Inspect application logs for high-frequency CImgIOException events tied to Analyze/NIfTI parsing
- Correlate file upload telemetry with resident set size (RSS) growth in worker processes
- Alert on files with .hdr, .img, or .nii extensions whose size is smaller than the declared header_size field
Monitoring Recommendations
- Track per-process memory usage of services linking against CImg and alert on sustained growth
- Monitor for OOM killer events in kernel logs on hosts running image processing workloads
- Log the CImg library version used by each application to identify unpatched deployments
How to Mitigate CVE-2026-47667
Immediate Actions Required
- Upgrade the CImg Library to version 4.0.0 or later on all systems that process image files
- Audit application code for direct calls to load_analyze() and load() on untrusted input
- Restrict upload sizes and enforce file-type validation before invoking CImg parsers
- Isolate image parsing in sandboxed processes with hard memory limits to contain resource exhaustion
Patch Information
CImg version 4.0.0 fixes the vulnerability by bounding header_size against the actual file size and correcting the allocation lifetime so the buffer is released on error paths. See the GitHub Commit to CImg, the GitHub CImg Issue Discussion, and the GitHub Security Advisory GHSA-rmfc-grgj-qwhv for details.
Workarounds
- Reject files smaller than the minimum valid Analyze/NIfTI header size (348 bytes) before parsing
- Parse the first 4 bytes independently and validate that header_size does not exceed the on-disk file size
- Run image processing workers under strict cgroups or container memory limits to bound impact from unpatched code paths
# Configuration example: enforce a memory limit on the image parsing service
systemctl set-property image-parser.service MemoryMax=512M MemoryHigh=384M
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
