CVE-2018-7587

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers...

7.8 HighFix available

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.09%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.

Record: CVE-2018-7587
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.

Record: CVE-2018-7587
Updated: 2026-11-02

EUVDEUVD-2018-19308 No score

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.

Record: EUVD-2018-19308
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vrf4-rm5p-c95x 7.8

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers...

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.

Record: GHSA-vrf4-rm5p-c95x
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 7.8

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.

Record: CVE-2018-7587
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-7587 7.8

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.

Record: DEBIAN-CVE-2018-7587
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-7587 7.8

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.

Record: UBUNTU-CVE-2018-7587
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2018-0438 No score

Updated cimg and gmic packages fix security vulnerabilities

Updated cimg and gmic packages fix security vulnerabilities:

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h (CVE-2018-7587).

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image (CVE-2018-7588).

An issue was discovered in CImg v.220. A double free in load_bmp in CImg.h occurs when loading a crafted bmp image (CVE-2018-7589).

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image. This is in a "16 colors" case, aka case 4 (CVE-2018-7637).

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image. This is in a "256 colors" case, aka case 8 (CVE-2018-7638).

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image. This is in a "16 bits colors" case, aka case 16 (CVE-2018-7639).

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image. This is in a Monochrome case, aka case 1 (CVE-2018-7640).

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image. This is in a "32 bits colors" case, aka case 32 (CVE-2018-7641).

Record: MGASA-2018-0438
Updated: 2026-11-02

OSVUSN-4039-1 No score

CImg vulnerabilities

It was discovered that allocation failures could occur in CImg when loading crafted bmp images. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-7587)

It was discovered that a heap-based buffer over-read existed in CImg when loading crafted bmp images. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7588)

It was discovered that a double free existed in CImg when loading crafted bmp images. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7589)

Record: USN-4039-1
Updated: 2026-11-02

Affected products

cimg

Affected packages

Affected packages
Package	Affected	Fixed
`cimg` Debian:12	All versions, plus listed versions 3.2.1+dfsg-13.2.1+dfsg-23.5.0+dfsg-13.5.2+dfsg-13.5.2+dfsg-24.0.4+dfsg-1	None known
`cimg` Debian:13	All versions, plus listed versions 3.5.2+dfsg-13.5.2+dfsg-1+deb13u13.5.2+dfsg-24.0.4+dfsg-1	None known
`cimg` Debian:14	All versions, plus listed versions 3.5.2+dfsg-13.5.2+dfsg-24.0.4+dfsg-1	None known
`cimg` Mageia:6	before 2.4.0-1.mga6	2.4.0-1.mga6
`gmic` Mageia:6	before 2.4.0-1.2.mga6	2.4.0-1.2.mga6
`cimg` Ubuntu:16.04:LTS	All versions, plus listed versions 1.6.4+dfsg-1build11.6.5+dfsg-1	None known
`cimg` Ubuntu:18.04:LTS	before 1.7.9+dfsg-2ubuntu0.18.04.1, plus listed versions 1.7.9+dfsg-21.7.9+dfsg-2build1	1.7.9+dfsg-2ubuntu0.18.04.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-7587 is a high vulnerability (CVSS 7.8) in Cimg, published March 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in cimg 2.4.0-1.mga6.

References

Show 8 moreShow less