Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111149— FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits

Quick assessment

Affected
danoli3 FreeImage
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreeImage（danoli3 分支）3.19.23 及之前版本在 PluginPICT.cpp 中的 Unpack32Bits() 函数存在一个堆缓冲区越界读取漏洞。该漏洞的原因是代码未对 rowBytes 进行检查，以验证其是否超出由文件控制的 PixMap 宽度限制。攻击者可构造包含截断或过小的 rowBytes 值的恶意 PICT 文件，导致最多 64 KiB 的堆内存被越界读取，从而可能将敏感内存内容泄露到解码后的像素数据中，或导致程序崩溃。

CVSS 6.1 · Medium EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1200 · Hardware Additions

Affected Version Matrix 2

VendorProduct Version RangeStatus
danoli3 FreeImage ≤ 3.19.23 affected
FreeImage FreeImage ≤ 3.18.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111149

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits
Source: CVE Program / CVE List V5
Vulnerability Description
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
danoli3 FreeImage 0 ~ 3.19.23 -
FreeImage FreeImage 0 ~ 3.18.0 -

II. Public POCs for CVE-2026-111149

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111149

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111149 (1)

Security Blog Posts for CVE-2026-111149 (1)

Other References for CVE-2026-111149 (1)

IV. Related Vulnerabilities

Same product: FreeImage
Same weakness: CWE-125

V. Comments for CVE-2026-111149

No comments yet

Leave a comment