FreeImage (danoli3 fork): Heap buffer overflow in GIF playback
Summary
The danoli3 fork of FreeImage before 3.19.25 contains a heap buffer overflow in PluginGIF.cpp. A crafted GIF whose frame rectangle exceeds the logical screen width causes heap memory corruption when loaded with GIF_PLAYBACK. An attacker can write past the canvas allocation; code execution is not confirmed. Exploitation requires a local context and user interaction, such as opening a malicious GIF, but no privileges.
Affected
- danoli3 FreeImage fork: all versions before 3.19.25
- Upstream FreeImage (SourceForge): versions up to and including 3.18.0 according to the CNA record
Fixed in
- danoli3 FreeImage fork: 3.19.25 (released 17 Oct 2026, fix in PR #183)
- Upstream FreeImage: Unknown.
Workaround
- Do not pass untrusted GIF files through the GIF_PLAYBACK path until patched (own suggestion, not from the vendor).
- Remove the GIF plugin from applications that do not need it.
- Generic memory protections such as ASLR and heap hardening reduce exploitability but do not fix the flaw.
Exploitation
- No public proof of concept found; this is not proof that none exists.
- Not known to be exploited and not listed in CISA KEV.
- Code execution is not confirmed.
Our recommendation
- Inventory applications and vendor products that bundle FreeImage, especially those that process user-supplied GIFs.
- Ask vendors whether their builds use 3.19.25 or later.
- Track distribution packages; Ubuntu rated the issue Medium and marked packages as Needs evaluation at the time of checking.
- Monitor the vendor release page and advisories for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- danoli3 FreeImage release 3.19.25 github.com
- danoli3 FreeImage pull request 183 github.com
- danoli3 FreeImage pull request 244 github.com
- Ubuntu security record CVE-2026-118753 ubuntu.com
- VulDB CVE-2026-118753 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:51.
Original description (NVD)
FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
NVD references (7)
- https://github.com/danoli3/FreeImage
- https://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772
- https://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034
- https://github.com/danoli3/FreeImage/commit/96f4099f8e307484ba69b4aa14d772b7679a1bfb
- https://github.com/danoli3/FreeImage/pull/183
- https://github.com/danoli3/FreeImage/releases/tag/3.19.25
- https://www.vulncheck.com/advisories/freeimage-danoli3-fork-before-3.19.25-heap-buffer-overflow-via-gif-playb…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.