CVE-2026-118752: FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder
FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs to convince a user or application to process a crafted IFF/LBM PBM file. The CVSS vector indicates local attack vector, no privileges required, and user interaction required.
Which FreeImage versions are affected?
The issue affects the danoli3 fork of FreeImage before version 3.19.22. Version 3.19.22 is not identified as affected by the provided information.
What is the potential impact of processing a malicious file?
A crafted ByteRun1 sequence can write up to 127 attacker-controlled bytes past the heap-allocated bitmap. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.