FreeImage: Heap buffer overflow in PBM RLE decoder (CVE-2026-118752)
The danoli3 fork of the FreeImage library before 3.19.22 contains a heap buffer overflow in the PBM RLE decoder of PluginIFF.cpp due to missing bounds checks on ByteRun1 runs.
CVE search metadata
CVE search record: CVE-2026-118752. Severity: high. CVSS: 7.8. KEV: no. Product: FreeImage (danoli3 fork) < 3.19.22. Brief: FreeImage: Heap buffer overflow in PBM RLE decoder (CVE-2026-118752). Brief link: https://feed.craftedsignal.io/briefs/2026-10-freeimage-heap-overflow/
Triage facts
Revision 1- Applicability
- FreeImage (danoli3 fork) < 3.19.22
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 22:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-118752 affects the danoli3 fork of the FreeImage library prior to 3.19.22. A heap buffer overflow exists in the PBM RLE decoder of PluginIFF.cpp, which lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.