FreeImage Library, in its 3.19.23 release, contains a heap out‑of‑bounds read in the Unpack32Bits function of PluginPICT.cpp. Because the rowBytes field is not validated against the PICT file’s PixMap width, a crafted image can cause the routine to read up to 64 KiB beyond the intended buffer. The over‑read may expose arbitrary heap contents to the contents of the decoded pixel array, or cause the process to crash, resulting in potential information disclosure or denial of service. This weakness corresponds to CWE‑125.

The vulnerability applies to the open‑source FreeImage project, specifically the danoli3 fork, and versions up to and including 3.19.23. Applications that incorporate this library for processing PICT images are affected.

The CVSS score of 6.9 indicates a moderate impact, while the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to supply a malicious PICT file that is processed by the vulnerable library; local or remote exploitation is possible if an application trusts user-supplied image files.