CImg Library is a C++ library for image processing. Prior to version 4.0.0 in "_load_analyze()", the header_size field is read as an "unsigned int" from the first 4 bytes of an Analyze/NIfTI file and passed directly to "new unsigned char[header_size]" without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent "fread" returns "short" as it will for any malformed file), the function throws a "CImgIOException" and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via "load_analyze()" and the generic "load()" when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.