FreeImage, a popular image processing library, contains a heap buffer overflow located in the PBM RLE decoder within PluginIFF.cpp. The overflow arises from missing bounds checks on ByteRun1 run lengths, allowing an attacker to supply a crafted IFF/LBM PBM file with runs that cross scanline boundaries and write up to 127 bytes past the allocated bitmap buffer. This memory corruption could overwrite adjacent heap data, potentially leading to arbitrary code execution, privilege escalation, or denial‑of‑service if the corrupted data influences control flow.

All releases of FreeImage 3.19.21 and earlier, including the danoli3 fork up to version 3.19.21, are affected. The vulnerability is not present in FreeImage 3.19.22 or later, as the issue was fixed in that release. The affected product is the FreeImage library as packaged by the FreeImage project and the danoli3 fork.

Basing on the CVSS score of 8.5, the vulnerability is considered high severity. The EPSS score is not available, so we cannot estimate current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a file‑based supply of a malicious IFF/LBM PBM image, either locally by a user exploiting an application that uses FreeImage or remotely if the application processes image files from untrusted network sources. Because the overflow writes controlled bytes into the heap, a well‑positioned attacker could leverage surrounding memory to achieve arbitrary code execution, though the limited write size requires careful exploitation.