FreeImage (danoli3 fork): Heap buffer overflow in IFF/LBM PBM RLE decoder
Summary
The danoli3 fork of the FreeImage image library before 3.19.22 contains a heap buffer overflow in the PBM RLE decoder of its IFF/LBM plugin (PluginIFF.cpp). An attacker can supply a crafted IFF/LBM/PBM file with runs that straddle scanline ends, which writes up to 127 attacker-controlled bytes past a heap-allocated bitmap. Applications that load such images from untrusted sources can crash or may be abused further; the vendor and the CVE record do not confirm code execution.
Affected
- danoli3 FreeImage: 0 to before 3.19.22 (CVE record; VulDB states up to 3.19.21)
- FreeImage (upstream, CVE record lists 0 to 3.18.0; not verified against a primary source)
Fixed in
- danoli3 FreeImage 3.19.22 (released 14 Oct 2026), which adds scanline bounds checks for literal and repeated pixels
Workaround
- No workaround is documented by the vendor. Upgrading to 3.19.22 is the recommended action.
- Interim measures based on general practice, not on the advisory: reject IFF/LBM/PBM uploads from untrusted users at the application or gateway layer, and run image conversion in an isolated process or container.
Exploitation
- No evidence of exploitation in the wild found; no CISA KEV entry.
- Public PoC status unclear: VulDB reports no available exploit, while OffSeq mentions Metasploit modules and nuclei templates that could not be verified.
- The reporter's public issue #156 describes the crash.
Our recommendation
- Check whether any software in your inventory bundles the danoli3 FreeImage library (for example FreeImage.dll or libfreeimage) and parses IFF, LBM or PBM files.
- Ask vendors of such software for a build with FreeImage 3.19.22 or later, and update as soon as one is available.
- Prioritise internet-facing upload services and converters; for them, block or isolate IFF/LBM/PBM processing until patched.
- Verify the attack vector and severity against the NVD record, since the CVSS 4.0 vector (AV:L, UI:P) and the VulDB description (remote) differ.
- Monitor vendor and CERT advisories for new exploit activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- FreeImage 3.19.22 release (danoli3) github.com
- PluginIFF.cpp at 3.19.21 (vulnerable code) github.com
- Issue #156 (danoli3 FreeImage) github.com
- Pull request #161 (danoli3 FreeImage) github.com
- VulnCheck advisory www.vulncheck.com
- Ubuntu security notice CVE-2026-118752 ubuntu.com
- VulDB CVE-2026-118752 vuldb.com
- Strix CVE-2026-118752 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:51.
Original description (NVD)
FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
NVD references (8)
- https://github.com/danoli3/FreeImage
- https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324
- https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45
- https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712
- https://github.com/danoli3/FreeImage/issues/156
- https://github.com/danoli3/FreeImage/pull/161
- https://github.com/danoli3/FreeImage/releases/tag/3.19.22
- https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.