CVE-2026-118752— FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder

Quick assessment

Affected

danoli3 FreeImage

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 3.19.22 版本之前的 FreeImage（danoli3 分支）中，PluginIFF.cpp 文件的 PBM RLE 解码器存在堆缓冲区溢出漏洞。该解码器未对 ByteRun1 运行进行边界检查。攻击者可构造一个 IFF/LBM PBM 文件，其中包含跨越扫描行末尾的运行数据，从而在堆分配的位图之后写入多达 127 个受控字节。

CVSS 7.8 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder

Source: CVE Program / CVE List V5

Vulnerability Description

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
danoli3	FreeImage	0 ~ 3.19.22	-
FreeImage	FreeImage	0 ~ 3.18.0	-

II. Public POCs for CVE-2026-118752

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118752

请登录查看更多情报信息。

Other References for CVE-2026-118752 (1)

🔗 GitHub - danoli3/FreeImage: FreeImage library - With Fixes for ALL PLATFORMS · GitHub product

Other References for CVE-2026-118752 (7)

https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45 patch
https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712 patch
https://github.com/danoli3/FreeImage/pull/161 patch issue-tracking
https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324 technical-description
https://github.com/danoli3/FreeImage/issues/156 issue-tracking
https://github.com/danoli3/FreeImage/releases/tag/3.19.22 release-notes
https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118752

IV. Related Vulnerabilities

Same product: FreeImage

Same vendor: danoli3

Same weakness: CWE-787