CVE-2026-111149
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes.
Risk Assessment
This can leak up to 64 KiB of heap memory into decoded pixels or crash the process handling untrusted PICT images.
Recommendation
Update FreeImage to a version containing the fix or avoid processing untrusted PICT files.
Other vulnerabilities in FreeImage
Original NVD description (English source)
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS