CVE-2026-42144 — Buffer Overflow

title: CImg Library Integer Overflow in _load_pnm() - CVE-2026-42144
id: scw-2026-05-04-ai-1
status: experimental
level: medium
description: |
  Detects processes that appear to be using the CImg library (indicated by 'CImg' in the image name) and are attempting to load PNM, PGM, or PPM files. This rule specifically looks for command lines that might indicate the vulnerable size computation logic ('W*H*D') which is part of the integer overflow vulnerability in _load_pnm() leading to potential heap buffer overflows. This is a primary detection for the initial exploitation vector.
author: SCW Feed Engine (AI-generated)
date: 2026-05-04
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42144/
tags:
  - attack.execution
  - attack.t1204.002
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - 'CImg'
      CommandLine|contains:
          - '.pnm'
          - '.pgm'
          - '.ppm'
  selection_size_computation:
      CommandLine|contains:
          - 'W*H*D'
  condition: selection AND selection_size_computation
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse