CVE-2026-118753 in FreeImage
Summary
by MITRE • 10/28/2026
FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in FreeImage versions prior to 3.19.25 represents a critical security flaw within the library's handling of Graphics Interchange Format files, specifically targeting the PluginGIF.cpp module. This issue manifests as a heap buffer overflow, which is categorized under CWE-122: Heap-based Buffer Overflow. The root cause lies in insufficient validation of geometric parameters extracted from GIF file headers during the playback process. When an application utilizes FreeImage with GIF_PLAYBACK enabled to animate or composite frames, it relies on internal functions such as GifPlaybackCompositeFrame and GifPlaybackFillRect to render image data onto a canvas buffer allocated for that purpose. The flaw occurs because these functions fail to verify whether the dimensions of individual frame rectangles are consistent with the logical screen width defined in the GIF header.
Specifically, an attacker can craft a malicious GIF file where the sum of the left coordinate and the width value exceeds the declared logical screen width. In standard image processing logic, this condition should trigger a clipping operation to ensure that drawing operations remain within the bounds of the allocated memory buffer representing the canvas. However, due to the missing boundary checks in the affected code path, the rendering engine proceeds with writing pixel data beyond the end of the heap-allocated buffer. This out-of-bounds write corrupts adjacent memory regions on the heap, potentially overwriting critical metadata structures such as allocation headers or pointers used by the dynamic memory allocator.
The operational impact of this vulnerability is severe and multifaceted. From a confidentiality perspective, writing past the allocated boundary may allow an attacker to read sensitive data residing in neighboring memory blocks if subsequent operations involve reading from those corrupted areas. More critically, from an integrity and availability standpoint, heap corruption can lead to application crashes or denial-of-service conditions when the allocator detects inconsistencies during future allocation or deallocation requests. Furthermore, sophisticated exploitation techniques could leverage this memory corruption to achieve arbitrary code execution. By carefully controlling the data written into the overflowed region, a remote attacker might overwrite function pointers or return addresses within the heap structure, thereby redirecting program control flow to malicious shellcode injected elsewhere in the process memory space.
This vulnerability aligns with MITRE ATT&CK technique T1203: Exploitation for Client Execution, as it targets client-side applications that render images, such as web browsers, image viewers, or document processors integrating FreeImage. The attack vector is typically remote via a crafted file delivered through email attachments, malicious websites, or compromised content delivery networks. Defense in depth strategies are essential to mitigate this risk. Organizations should immediately update the FreeImage library to version 3.19.25 or later where these boundary checks have been implemented. For environments unable to patch immediately, input validation at the application layer can serve as a temporary mitigation by rejecting GIF files with frame dimensions that exceed logical screen constraints before passing them to the rendering engine. Additionally, enabling modern memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Heap Protection features in operating systems like Windows Data Execution Prevention or Linux heap hardening options can significantly raise the barrier for successful exploitation of this specific buffer overflow condition.