CVE-2026-118753: FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing
FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIFPLAYBACK.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using the danoli3 fork of FreeImage before 3.19.25 are affected if they load GIF files with GIF_PLAYBACK enabled.
What does an attacker need to trigger the issue?
An attacker needs to provide a crafted GIF containing frame coordinates or dimensions that extend beyond the logical screen width, and the application must load it using GIF_PLAYBACK. The supplied vector indicates no privileges are required, but user interaction is required.
How can I determine whether my application is exposed?
Check whether it uses the danoli3 FreeImage fork at a version earlier than 3.19.25 and whether its GIF handling invokes GIF_PLAYBACK. Applications that do not process attacker-controlled GIFs through that path are not exposed through the described condition.
What can be done if an update cannot be applied immediately?
Avoid loading untrusted GIF files with GIF_PLAYBACK until the affected FreeImage version can be updated to 3.19.25 or later.