See how freeimage compares to other vendors in security performance
FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Load() function when reading images in RAS format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the ReadData() function when reading images in RAS format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the assignPixel<>() function when reading images in TARGA format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the AssignPixel() function when reading images in TIFF format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the rgbeRGBEToFloat() function when reading images in HDR format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the readLine() function when reading images in XPM format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf22::Xdr::read() function when reading images in EXR format.
A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the readiptcprofile function in the Source/Metadata/IPTC.cpp file because the size of the profile is not being sanitized, causing a crash in the application linked to the library, resulting in a denial of service.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf22::copyIntoFrameBuffer() component when reading images in EXR format.
An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted PSD file.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the FreeImageUnload() function when reading images in HDR format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the Imf22::CharPtrIO::readChars() function when reading images in EXR format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the opjj2kreadmct() function when reading images in J2K format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the jpegreadexifprofile() function when reading images in JPEG format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the FreeImageSetTagValue() function when reading images in JPEG format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the opjj2kcopydefaulttcpandcreatetcd() function when reading images in J2K format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the FreeImageCreateICCProfile() function when reading images in TIFF format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the readiptcprofile() function when reading images in TIFF format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the Imf22::DwaCompressor::Classifier::Classifier() function when reading images in EXR format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the opjj2ktcpdestroy() function when reading images in J2K format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the fillinputbuffer() function when reading images in JPEG format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the processMakerNote() function when reading images in JPEG format.
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the psdParser::ReadImageData() function when reading images in PSD format.
Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the jpegreadexifprofileraw() function when reading images in JPEG format.
While doing fuzzing with AFL++ & Sydr. I found heap buffer overflow in readiptcprofile:
==376632==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000091 at pc 0x000000730e1d bp 0x7fffffffda90 sp 0x7fffffffda88 READ of size 1 at 0x602000000091 thread T0 [Detaching after fork from child process 376675] #0 0x730e1c in readiptcprofile /freeimage-svn/FreeImage/trunk/Source/Metadata/IPTC.cpp:74:7 #1 0x654cae in tiffreadiptcprofile(tiff, FIBITMAP) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:790:10 #2 0x654cae in ReadMetadata(FreeImageIO, void, tiff, FIBITMAP) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:871:2 #3 0x64e5a2 in Load(FreeImageIO, void, int, int, void) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:2320:3 #4 0x508deb in FreeImageLoadFromHandle /freeimage-svn/FreeImage/trunk/Source/FreeImage/Plugin.cpp:386:24 #5 0x4ff0bb in FreeImageLoadFromMemory /freeimage-svn/FreeImage/trunk/Source/FreeImage/MemoryIO.cpp:88:10 #6 0x4e0505 in LLVMFuzzerTestOneInput /loadfrommemorytifffuzzer.cc:35:26 #7 0x4e00c4 in main /afl.cc:36:9 #8 0x7ffff7a730b2 in libcstartmain /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16 #9 0x425fbd in start (/loadfrommemorytiffafl+0x425fbd)
In File /freeimage-svn/FreeImage/trunk/Source/Metadata/IPTC.cpp:74
71 // find start of the BIM portion of the binary data 72 sizet offset = 0; 73 while(offset < length - 1) { --->74 if((profile[offset] == 0x1C) && (profile[offset+1] == 0x02)) 75 break; 76 offset++; 77 } 78 79 // for each tag 80 while (offset < length) { 81 82 // identifies start of a tag
Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the J2KImageToFIBITMAP() function when reading images in J2K format.
======================================================================== CVE-2022-4988 CPAN Security Group ========================================================================
CVE ID: CVE-2022-4988 Distribution: Alien-FreeImage Versions: through 1.001
MetaCPAN: https://metacpan.org/dist/Alien-FreeImage VCS Repo: https://github.com/kmx/alien-freeimage
Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries
Description ----------- Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries.
Alien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities such as CVE-2015-0852 and CVE-2025-65803. The library embeds other images libraries that also have known vulnerabilities.
Problem types ------------- - CWE-1395 Dependency on Vulnerable Third-Party Component
Workarounds ----------- The latest version of the FreeImage library is 3.18.0 from 2018, which also appears to have serious vulnerabilities.
Users are advised to use alternatives.
References ---------- https://freeimage.sourceforge.io/ https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source https://nvd.nist.gov/vuln/detail/CVE-2015-0852 https://nvd.nist.gov/vuln/detail/CVE-2025-65803 https://github.com/kmx/alien-freeimage/issues/4 https://github.com/kmx/alien-freeimage/issues/5
Timeline -------- - 2017-07-11: Alien::FreeImage released with FreeImage 3.17.0 - 2022-06-29: Issues added to git repository regarding security vulnerabilities - 2022-06-29: Several issues added to CPANSA::DB - 2026-03-27: Issues logged with CPANSec