CVE-2025-70968
CriticalSummary
FreeImage 3.18.0 contains a Use After Free vulnerability in PluginTARGA.cpp in the loadRLE() function. Memory is freed and then accessed again, potentially leading to undefined behavior.
Risk Assessment
Processing specially crafted TARGA files could crash the application or potentially allow code execution, threatening system integrity.
Recommendation
Upgrade FreeImage to a newer version that includes a fix for this vulnerability, if available.
Other vulnerabilities in FreeImage
See all- CVE-2026-118753High
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
- CVE-2026-118752High
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
- CVE-2026-111149Medium
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes.
Original NVD description (English source)
FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS