CVE-2026-118752 in FreeImage
Summary
by MITRE • 10/29/2026
FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in FreeImage, specifically within the danoli3 fork prior to version 3.19.22, represents a critical memory safety failure located in the PBM RLE decoder component of PluginIFF.cpp. This flaw stems from an insufficient validation mechanism when processing Run-Length Encoded (RLE) data structures inherent to IFF/LBM image formats. The core technical deficiency lies in the handling of ByteRun1 runs, which define sequences of repeated pixel values or raw byte streams within the compressed bitmap data. During the decoding process, the software fails to perform rigorous bounds checking on these run lengths relative to the allocated memory buffer for the bitmap. This oversight allows an attacker who supplies a maliciously crafted IFF/LBM PBM file containing runs that straddle scanline boundaries to trigger out-of-bounds writes. Specifically, the decoder does not correctly account for the transition between rows or the total size of the destination heap-allocated bitmap, leading to a situation where data is written beyond the intended memory allocation limits.
From an operational perspective, this heap buffer overflow poses severe risks to system stability and security integrity. By writing up to 127 controlled bytes past the end of the heap-allocated bitmap, an attacker can corrupt adjacent memory structures on the heap. This corruption can lead to application crashes, resulting in a denial-of-service condition for users relying on FreeImage for image processing tasks. More critically, if specific memory layouts are exploited, this out-of-bounds write could potentially overwrite function pointers or object headers, enabling arbitrary code execution with the privileges of the process running the vulnerable software. The ability to control up to 127 bytes provides sufficient payload space for sophisticated exploitation techniques, making this vulnerability a significant threat vector in environments where untrusted image files are processed automatically or by end-users without strict input sanitization layers.
This flaw is categorized under CWE-122, which denotes heap-based buffer overflow, highlighting the improper allocation and boundary checking of memory resources on the heap segment. Furthermore, the exploitation technique aligns with ATT&CK tactic Tactic TA0004, specifically referencing techniques related to privilege escalation or defense evasion through memory corruption if used in conjunction with other vulnerabilities. The lack of bounds checks is a classic implementation error that underscores the importance of rigorous input validation and safe memory management practices in image parsing libraries. Developers must ensure that all run lengths are validated against the remaining buffer size before any copy operations occur, particularly when dealing with variable-length encodings like RLE where boundary conditions at scanline ends are common edge cases.
To mitigate this vulnerability, immediate updates to FreeImage version 3.19.22 or later are required, as these versions include patches that enforce proper bounds checking on ByteRun1 runs within the PBM decoder. For systems unable to update immediately, implementing a sandboxed environment for processing untrusted image files can reduce the impact of potential exploitation. Additionally, integrating fuzzing tools into the development pipeline specifically targeting IFF/LBM parsers can help identify similar boundary condition errors before they reach production. Security teams should also consider deploying input validation filters that reject malformed RLE structures or enforce strict limits on run lengths consistent with standard-compliant image specifications to prevent such overflow conditions from being triggered in downstream applications.