CVE-2026-118753
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
Risk Assessment
A malicious GIF processed in GIF_PLAYBACK mode may cause memory corruption and potential code execution in the application context. Risk affects systems using FreeImage to process untrusted GIF images.
Recommendation
Update FreeImage to version 3.19.25 (danoli3 fork) or later containing the fix. Until updated, avoid processing untrusted GIF files in GIF_PLAYBACK mode.
Other vulnerabilities in FreeImage
See all- CVE-2025-70968Critical
FreeImage 3.18.0 contains a Use After Free vulnerability in PluginTARGA.cpp in the loadRLE() function. Memory is freed and then accessed again, potentially leading to undefined behavior.
- CVE-2026-118752High
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
- CVE-2026-111149Medium
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes.
Original NVD description (English source)
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS