Description
FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
Published: 2026-10-28
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Remote code execution through heap buffer overflow
Action: Immediate Patch
AI Analysis

Impact

The danoli3 fork of FreeImage before version 3.19.25 contains a heap buffer overflow in the GIF processing code. When a GIF file with frame rectangles that extend beyond the logical screen width is loaded with GIF_PLAYBACK, the library writes past the allocated canvas buffer, corrupting adjacent heap memory. This out‑of‑bounds write (CWE‑787) can lead to program state corruption or arbitrary code execution.

Affected Systems

The flaw affects the FreeImage library maintained by the FreeImage Project and the danoli3 fork. All releases prior to 3.19.25 are impacted; an attacker must be able to supply a crafted GIF to an application that uses FreeImage's GIF_PLAYBACK mode.

Risk and Exploitability

The CVSS base score of 8.5 indicates high severity. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog. Attackers can deliver a malicious GIF to software that loads images from untrusted sources, enabling a remote attack, or locally through user‑supplied files. Although no public exploit is known, the lack of a patch for legacy installations increases the risk of exploitation.

Generated by OpenCVE AI on October 28, 2026 at 22:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to FreeImage 3.19.25 or later to remove the out‑of‑bounds write.
  • Reject or sanitize GIF files whose frame bounds exceed the logical screen dimensions before passing them to GIF_PLAYBACK mode.
  • If an upgrade cannot be performed immediately, run image‑processing code that uses FreeImage in a sandboxed or least‑privileged process to contain possible memory corruption.

Generated by OpenCVE AI on October 28, 2026 at 22:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
Title FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing
First Time appeared Freeimage Project
Freeimage Project freeimage
Weaknesses CWE-787
CPEs cpe:2.3:a:freeimage_project:freeimage:*:*:*:*:*:*:*:*
Vendors & Products Freeimage Project
Freeimage Project freeimage
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freeimage Project Freeimage
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-28T21:11:22.192Z

Reserved: 2026-10-28T19:13:08.786Z

Link: CVE-2026-118753

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-28T22:17:14.047

Modified: 2026-10-28T22:17:14.170

Link: CVE-2026-118753

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T22:30:12Z

Weaknesses