CVE-2026-111149: FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the danoli3 FreeImage fork through 3.19.23 are exposed when they decode attacker-controlled PICT files. Exploitation requires a user or application workflow that opens or processes the crafted image.
What does an attacker need to do to exploit it?
An attacker needs to provide a crafted PICT file with a truncated or undersized rowBytes value relative to the file-controlled PixMap width. No privileges are required, but user interaction is required to cause the file to be decoded.
What is the likely impact of successful exploitation?
The vulnerable decoding path can read up to 64 KiB beyond a heap allocation. This may leak heap memory into decoded pixel output or crash the process.
How can exposure be reduced if an update is not immediately available?
Avoid decoding untrusted PICT files with affected FreeImage versions. Restrict or disable PICT processing in workflows that accept externally supplied images where possible.