CVE-2026-111149: FreeImage 0 through 3.19.23, 0 through 3.18.0

Affected technology

FreeImage · 0 through 3.19.23
danoli3

FreeImage · 0 through 3.18.0
FreeImage

Description’s affected range: through 3.19.23

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as low; integrity impact as none; availability impact as high.