CVE-2026-118752
FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder
danoli3 FreeImage
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.19.22FreeImageCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
Text from CVE List
Affected versions 2
- FreeImageaffected: all versions before 3.19.22CVE List
- FreeImageaffected: all versions through 3.18.0CVE List
References 8
- github.com/danoli3/FreeImage/pull/161Fixvia CVE List
- github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712Fixvia CVE List
- github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45Fixvia CVE List
- github.com/danoli3/FreeImage/releases/tag/3.19.22Fixvia CVE List
- vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoderAdvisoryvia CVE List
- github.com/danoli3/FreeImage/issues/156Referencevia CVE List
- github.com/danoli3/FreeImageReferencevia CVE List
- github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324Referencevia CVE List