CVE-2026-118752

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118752", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-28T19:13:08.429Z", "datePublished": "2026-10-28T21:11:21.485Z", "dateUpdated": "2026-11-05T16:52:17.495Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T21:01:25.408Z"}, "datePublic": "2026-10-12T00:00:00.000Z", "title": "FreeImage through 3.18.0 and danoli3 fork before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder", "descriptions": [{"lang": "en", "value": "FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "danoli3", "product": "FreeImage", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "3.19.22", "status": "affected", "versionType": "semver"}], "collectionURL": "https://github.com", "packageURL": "pkg:github/danoli3/FreeImage", "repo": "https://github.com/danoli3/FreeImage"}, {"vendor": "FreeImage", "product": "FreeImage", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "3.18.0", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:freeimage_project:freeimage:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.18.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/danoli3/FreeImage/issues/156", "tags": ["issue-tracking"], "name": "GitHub Issue #156"}, {"url": "https://github.com/danoli3/FreeImage", "tags": ["product"]}, {"url": "https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324", "tags": ["technical-description"]}, {"url": "https://github.com/danoli3/FreeImage/pull/161", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712", "tags": ["patch"]}, {"url": "https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45", "tags": ["patch"]}, {"url": "https://github.com/danoli3/FreeImage/releases/tag/3.19.22", "tags": ["release-notes"], "name": "FreeImage 3.19.22 Release Notes"}, {"url": "https://github.com/danoli3/FreeImage/pull/244", "tags": ["release-notes"], "name": "Changelog naming CVE-2026-118752 and CVE-2026-118753"}, {"url": "https://sourceforge.net/projects/freeimage/", "tags": ["product"]}, {"url": "https://sourceforge.net/p/freeimage/patches/198/", "tags": ["patch", "issue-tracking"], "name": "Upstream patch submission #198"}, {"name": "VulnCheck Advisory: FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder"}], "credits": [{"lang": "en", "value": "areofyl", "type": "finder"}, {"lang": "en", "value": "Tristan Madani", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/danoli3/FreeImage/issues/156", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:52:09.032090Z", "id": "CVE-2026-118752", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:52:17.495Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118752", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T16:52:09.032090Z"}}}], "references": [{"url": "https://github.com/danoli3/FreeImage/issues/156", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:51:50.986Z"}}], "cna": {"title": "FreeImage through 3.18.0 and danoli3 fork before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder", "credits": [{"lang": "en", "type": "finder", "value": "areofyl"}, {"lang": "en", "type": "finder", "value": "Tristan Madani"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/danoli3/FreeImage", "vendor": "danoli3", "product": "FreeImage", "versions": [{"status": "affected", "version": "0", "lessThan": "3.19.22", "versionType": "semver"}], "packageURL": "pkg:github/danoli3/FreeImage", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}, {"vendor": "FreeImage", "product": "FreeImage", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.18.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-12T00:00:00.000Z", "references": [{"url": "https://github.com/danoli3/FreeImage/issues/156", "name": "GitHub Issue #156", "tags": ["issue-tracking"]}, {"url": "https://github.com/danoli3/FreeImage", "tags": ["product"]}, {"url": "https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324", "tags": ["technical-description"]}, {"url": "https://github.com/danoli3/FreeImage/pull/161", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712", "tags": ["patch"]}, {"url": "https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45", "tags": ["patch"]}, {"url": "https://github.com/danoli3/FreeImage/releases/tag/3.19.22", "name": "FreeImage 3.19.22 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/danoli3/FreeImage/pull/244", "name": "Changelog naming CVE-2026-118752 and CVE-2026-118753", "tags": ["release-notes"]}, {"url": "https://sourceforge.net/projects/freeimage/", "tags": ["product"]}, {"url": "https://sourceforge.net/p/freeimage/patches/198/", "name": "Upstream patch submission #198", "tags": ["patch", "issue-tracking"]}, {"url": "https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder", "name": "VulnCheck Advisory: FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freeimage_project:freeimage:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "3.18.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T21:01:25.408Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118752", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:52:17.495Z", "dateReserved": "2026-10-28T19:13:08.429Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-28T21:11:21.485Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com", "defaultStatus": "unaffected", "packageURL": "pkg:github/danoli3/FreeImage", "product": "FreeImage", "repo": "https://github.com/danoli3/FreeImage", "vendor": "danoli3", "versions": [{"lessThan": "3.19.22", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "FreeImage", "vendor": "FreeImage", "versions": [{"lessThanOrEqual": "3.18.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap."}], "id": "CVE-2026-118752", "lastModified": "2026-11-05T17:17:55.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118752", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:52:09.032090Z", "version": "2.0.3"}}]}, "published": "2026-10-28T22:17:13.857", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/issues/156"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/pull/161"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/pull/244"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/releases/tag/3.19.22"}, {"source": "disclosure@vulncheck.com", "url": "https://sourceforge.net/p/freeimage/patches/198/"}, {"source": "disclosure@vulncheck.com", "url": "https://sourceforge.net/projects/freeimage/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/danoli3/FreeImage/issues/156"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "freeimage: FreeImage: Arbitrary code execution via heap-based buffer overflow in image decoder", "id": "2563206", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563206"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.", "A flaw was found in FreeImage. This vulnerability allows an attacker to achieve arbitrary code execution or cause an application crash leading to a Denial of Service (DoS) by tricking a user or automated system into processing a specially crafted image file. The issue occurs due to a heap-based buffer overflow in the image decoder, where missing boundary checks allow data to be written beyond allocated memory limits."], "name": "CVE-2026-118752", "public_date": "2026-10-28T21:11:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118752\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118752\nhttps://github.com/danoli3/FreeImage\nhttps://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324\nhttps://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45\nhttps://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712\nhttps://github.com/danoli3/FreeImage/issues/156\nhttps://github.com/danoli3/FreeImage/pull/161\nhttps://github.com/danoli3/FreeImage/releases/tag/3.19.22\nhttps://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder"], "statement": "Red Hat has assessed this vulnerability as Important because an attacker can achieve code execution or process termination by supplying a malformed graphic file to an application that utilizes FreeImage. Exploitation requires user interaction or an automated pipeline to ingest untrusted input, yet the potential for memory corruption across the host process boundary elevates the severity above Moderate. In standard Red Hat Enterprise Linux environments, FreeImage is not included in base system repositories and is only available through Extra Packages for Enterprise Linux (EPEL), limiting direct exposure on default installations.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.19.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "FreeImage", "source": "cna", "vendor": "danoli3"}, "product": "freeimage", "vendor": "danoli3"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.18.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeImage", "source": "cna", "vendor": "FreeImage"}, "product": "freeimage", "vendor": "freeimage_project"}], "created": "2026-10-28T22:30:12.255670+00:00", "updated": "2026-11-03T01:00:08.917190+00:00", "vendors": ["danoli3", "danoli3$PRODUCT$freeimage", "freeimage_project", "freeimage_project$PRODUCT$freeimage"]}