Vulnerability Spotlight: Code execution vulnerabilities in LEADTOOLS
Summary: Cisco Talos discovered multiple code execution and denial-of-service vulnerabilities in LEADTOOLS 20, the LEAD Technologies imaging toolkit SDK used to build applications for medical systems and other platforms. The flaws include a heap out-of-bounds write in TIF parsing, an integer underflow in CMP parsing, an integer overflow in BMP header parsing, and a heap overflow in JPEG2000 j2pc parsing, each triggered by a specially crafted image file and potentially leading to code execution.
Why it matters: These vulnerabilities sit in an imaging SDK aimed at medical systems, where a single crafted TIF, CMP, BMP or J2K file can turn into remote code execution - and Talos worked with LEAD Technologies on an update, so the exposure lasts as long as affected deployments go unpatched.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5099CVE-2019-5125
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026