Heap Buffer Overflow in FreeImage PluginIFF Component

CVE-2026-118752

What is CVE-2026-118752?

The FreeImage library (danoli3 fork) prior to version 3.19.22 is susceptible to a heap buffer overflow in its PBM RLE decoder. This vulnerability arises from a lack of proper bounds checking on ByteRun1 runs within the PluginIFF.cpp file. By exploiting this flaw, an attacker can craft a malicious IFF or LBM PBM file that straddles scanline boundaries, leading to the potential overwrite of up to 127 bytes beyond the intended heap allocation. This can compromise application stability and may enable further exploits. Users are encouraged to upgrade to version 3.19.22 or later to mitigate this risk.

References