CVE-2026-118752
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
Risk Assessment
A malicious IFF/LBM file may cause heap memory corruption and potential code execution in the application context. Risk affects systems using FreeImage to process untrusted IFF/LBM files.
Recommendation
Update FreeImage to version 3.19.22 (danoli3 fork) or later containing the fix. Until updated, avoid processing untrusted IFF/LBM files.
Other vulnerabilities in FreeImage
See all- CVE-2025-70968Critical
FreeImage 3.18.0 contains a Use After Free vulnerability in PluginTARGA.cpp in the loadRLE() function. Memory is freed and then accessed again, potentially leading to undefined behavior.
- CVE-2026-118753High
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
- CVE-2026-111149Medium
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes.
Original NVD description (English source)
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS