CVE-2026-94030: SerenityOS LibGfx Buffer Overflow Vulnerability

CVE-2026-94030 Overview

CVE-2026-94030 is an integer overflow vulnerability in the SerenityOS LibGfx image handling component. The flaw resides in the decode_bmp_pixel_data function within Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp. Manipulating the height argument of a crafted BMP file triggers the overflow during image decoding. Researchers reproduced the issue with a 55-byte proof-of-concept through the standard image-decode fuzz target. SerenityOS follows a rolling release model, so the affected range is defined by commit history rather than version numbers. The vulnerability was categorized under [CWE-189] (Numeric Errors).

Critical Impact
Remote processing of a malicious BMP file can trigger an integer overflow in LibGfx, though the attack complexity is high and evidence of a practically exploitable defect is limited.

Affected Products

SerenityOS source tree up to commit 3d83e4509fd20d7438e1ae8470ffe668c136229c
LibGfx BMP image decoder (Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp)
Applications and services that consume LibGfx for BMP decoding

Discovery Timeline

2026-09-20 - CVE-2026-94030 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94030

Vulnerability Analysis

The vulnerability affects decode_bmp_pixel_data in the SerenityOS LibGfx BMP image loader. A specially crafted BMP header supplies a height value that cannot be represented safely in the arithmetic operations performed during pixel data decoding. The unchecked value causes an integer overflow ([CWE-189]) during size or offset calculations. Researchers demonstrated reproducibility via a minimal 55-byte input processed by the project's standard image-decode fuzz target. The advisory notes that evidence for a practically exploitable defect beyond the fuzzer trigger is thin, and the attack complexity is rated as high.

Root Cause

The root cause is missing bounds validation on the BMP height field before it participates in size arithmetic inside decode_bmp_pixel_data. Extreme or negative height values wrap during multiplication or accumulation. The upstream fix rejects BMPs whose height cannot be represented, using AK/NumericLimits.h to introduce explicit range checks.

Attack Vector

Exploitation requires an attacker to deliver a malformed BMP file to a target that decodes it through LibGfx. Successful triggering also requires user interaction, such as opening or previewing the file. The scope of impact is limited according to the advisory, with only a minor availability effect indicated.

cpp

// Source: https://github.com/SerenityOS/serenity/commit/007041bb2dd6d140c9e707caddfb0a49ecf96469
// Patch: LibGfx: Reject BMPs with an unrepresentable height
 #include <AK/Debug.h>
 #include <AK/Error.h>
 #include <AK/Function.h>
+#include <AK/NumericLimits.h>
 #include <AK/Try.h>
 #include <AK/Vector.h>
 #include <LibGfx/ImageFormats/BMPLoader.h>

The patch introduces AK/NumericLimits.h so the decoder can validate the BMP height against representable numeric bounds and reject inputs that would overflow.

Detection Methods for CVE-2026-94030

Indicators of Compromise

BMP files with header height fields set to extreme, negative, or otherwise unrepresentable values.
Unexpected crashes or aborts in processes that link against LibGfx when handling image content.
Sample inputs approximately 55 bytes in size resembling the published fuzz target reproduction case.

Detection Strategies

Deploy static analysis rules that flag arithmetic on untrusted image dimensions without explicit bounds checks.
Run the project's existing image-decode fuzz harness against LibGfx on any downstream fork to reproduce the crash.
Inspect BMP headers at ingestion points and reject files whose height exceeds sane rendering limits.

Monitoring Recommendations

Alert on abnormal termination of processes invoking BMP decoding routines in LibGfx.
Log inbound image files by source, size, and MIME type for post-incident correlation.
Track builds of SerenityOS-derived software and confirm the presence of commit 007041bb2dd6d140c9e707caddfb0a49ecf96469.

How to Mitigate CVE-2026-94030

Immediate Actions Required

Update SerenityOS or any downstream code embedding LibGfx to a build that includes patch commit 007041bb2dd6d140c9e707caddfb0a49ecf96469.
Audit forks and vendored copies of BMPLoader.cpp for the presence of the height validation logic.
Restrict BMP processing to trusted sources until the patch is deployed.

Patch Information

The fix is upstream in SerenityOS as commit 007041bb2dd6d140c9e707caddfb0a49ecf96469, titled "LibGfx: Reject BMPs with an unrepresentable height." See the GitHub Commit Update, the tracking GitHub Issue #26957, and the GitHub Pull Request #26958. SerenityOS uses a rolling release model, so consumers must rebuild from a tree containing the commit rather than relying on version numbering.

Workarounds

Disable automatic BMP thumbnail generation and preview in file managers that use LibGfx.
Filter or transcode inbound BMP files at a gateway to strip malformed headers before decoding.
Sandbox any process that performs LibGfx BMP decoding to contain crashes and limit blast radius.

bash

# Rebuild SerenityOS with the patched commit
git fetch origin
git checkout 007041bb2dd6d140c9e707caddfb0a49ecf96469
Meta/serenity.sh rebuild-toolchain
Meta/serenity.sh build