CVE-2026-118753

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118753", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-28T19:13:08.786Z", "datePublished": "2026-10-28T21:11:22.192Z", "dateUpdated": "2026-11-03T00:01:27.217Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T21:01:26.093Z"}, "datePublic": "2026-10-17T00:00:00.000Z", "title": "FreeImage through 3.18.0 and danoli3 fork before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing", "descriptions": [{"lang": "en", "value": "FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "danoli3", "product": "FreeImage", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "3.19.25"}, {"version": "3.19.25", "status": "unaffected", "versionType": "semver"}], "collectionURL": "https://github.com", "packageURL": "pkg:github/danoli3/FreeImage", "repo": "https://github.com/danoli3/FreeImage"}, {"vendor": "FreeImage", "product": "FreeImage", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "3.18.0", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:freeimage_project:freeimage:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.18.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/danoli3/FreeImage/pull/183", "tags": ["issue-tracking", "patch"], "name": "Pull Request #183"}, {"url": "https://github.com/danoli3/FreeImage/commit/96f4099f8e307484ba69b4aa14d772b7679a1bfb", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/danoli3/FreeImage", "tags": ["product"]}, {"url": "https://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772", "tags": ["technical-description"]}, {"url": "https://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034", "tags": ["patch"]}, {"url": "https://github.com/danoli3/FreeImage/releases/tag/3.19.25", "tags": ["release-notes"], "name": "FreeImage 3.19.25 Release Notes"}, {"url": "https://github.com/danoli3/FreeImage/pull/244", "tags": ["release-notes"], "name": "Changelog naming CVE-2026-118752 and CVE-2026-118753"}, {"url": "https://sourceforge.net/projects/freeimage/", "tags": ["product"]}, {"name": "VulnCheck Advisory: FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/freeimage-danoli3-fork-before-3.19.25-heap-buffer-overflow-via-gif-playback-compositing"}], "credits": [{"lang": "en", "value": "danoli3", "type": "remediation developer"}, {"lang": "en", "value": "Tristan Madani", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T00:01:16.240786Z", "id": "CVE-2026-118753", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T00:01:27.217Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118753", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T00:01:16.240786Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T00:01:21.934Z"}}], "cna": {"title": "FreeImage through 3.18.0 and danoli3 fork before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing", "credits": [{"lang": "en", "type": "remediation developer", "value": "danoli3"}, {"lang": "en", "type": "finder", "value": "Tristan Madani"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/danoli3/FreeImage", "vendor": "danoli3", "product": "FreeImage", "versions": [{"status": "affected", "version": "0", "lessThan": "3.19.25", "versionType": "semver"}, {"status": "unaffected", "version": "3.19.25", "versionType": "semver"}], "packageURL": "pkg:github/danoli3/FreeImage", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}, {"vendor": "FreeImage", "product": "FreeImage", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.18.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-17T00:00:00.000Z", "references": [{"url": "https://github.com/danoli3/FreeImage/pull/183", "name": "Pull Request #183", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/danoli3/FreeImage/commit/96f4099f8e307484ba69b4aa14d772b7679a1bfb", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/danoli3/FreeImage", "tags": ["product"]}, {"url": "https://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772", "tags": ["technical-description"]}, {"url": "https://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034", "tags": ["patch"]}, {"url": "https://github.com/danoli3/FreeImage/releases/tag/3.19.25", "name": "FreeImage 3.19.25 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/danoli3/FreeImage/pull/244", "name": "Changelog naming CVE-2026-118752 and CVE-2026-118753", "tags": ["release-notes"]}, {"url": "https://sourceforge.net/projects/freeimage/", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/freeimage-danoli3-fork-before-3.19.25-heap-buffer-overflow-via-gif-playback-compositing", "name": "VulnCheck Advisory: FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freeimage_project:freeimage:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "3.18.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T21:01:26.093Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118753", "state": "PUBLISHED", "dateUpdated": "2026-11-03T00:01:27.217Z", "dateReserved": "2026-10-28T19:13:08.786Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-28T21:11:22.192Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com", "defaultStatus": "unaffected", "packageURL": "pkg:github/danoli3/FreeImage", "product": "FreeImage", "repo": "https://github.com/danoli3/FreeImage", "vendor": "danoli3", "versions": [{"lessThan": "3.19.25", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "3.19.25", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "FreeImage", "vendor": "FreeImage", "versions": [{"lessThanOrEqual": "3.18.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK."}], "id": "CVE-2026-118753", "lastModified": "2026-11-03T00:17:18.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118753", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T00:01:16.240786Z", "version": "2.0.3"}}]}, "published": "2026-10-28T22:17:14.047", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/commit/96f4099f8e307484ba69b4aa14d772b7679a1bfb"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/pull/183"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/pull/244"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/danoli3/FreeImage/releases/tag/3.19.25"}, {"source": "disclosure@vulncheck.com", "url": "https://sourceforge.net/projects/freeimage/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/freeimage-danoli3-fork-before-3.19.25-heap-buffer-overflow-via-gif-playback-compositing"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "freeimage: freeimage: Arbitrary code execution via unclipped GIF frame dimensions", "id": "2563210", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563210"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.", "A flaw was found in FreeImage. By convincing a user or system to process a specially crafted GIF file with frame boundaries exceeding the logical screen width, an attacker can trigger a heap-based buffer overflow during image compositing. This flaw can corrupt heap memory, potentially leading to arbitrary code execution or a Denial of Service (DoS)."], "name": "CVE-2026-118753", "public_date": "2026-10-28T21:11:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118753\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118753\nhttps://github.com/danoli3/FreeImage\nhttps://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772\nhttps://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034\nhttps://github.com/danoli3/FreeImage/commit/96f4099f8e307484ba69b4aa14d772b7679a1bfb\nhttps://github.com/danoli3/FreeImage/pull/183\nhttps://github.com/danoli3/FreeImage/releases/tag/3.19.25\nhttps://www.vulncheck.com/advisories/freeimage-danoli3-fork-before-3.19.25-heap-buffer-overflow-via-gif-playback-compositing"], "statement": "This vulnerability is rated as having an Important severity because successful exploitation can allow an unauthenticated attacker to execute arbitrary code or crash the application in the context of the user running the process. Although FreeImage is not shipped as part of the core Red Hat Enterprise Linux distribution, it is available through EPEL and may be linked by third-party or custom software processing untrusted graphics. Exploitation requires user interaction or an automated service to load a maliciously formatted image file.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.19.25)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.19.25"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "FreeImage", "source": "cna", "vendor": "danoli3"}, "product": "freeimage", "vendor": "danoli3"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.18.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeImage", "source": "cna", "vendor": "FreeImage"}, "product": "freeimage", "vendor": "freeimage_project"}], "created": "2026-10-28T22:30:12.255522+00:00", "updated": "2026-11-03T00:00:20.512221+00:00", "vendors": ["danoli3", "danoli3$PRODUCT$freeimage", "freeimage_project", "freeimage_project$PRODUCT$freeimage"]}