High 7.3Published May 11, 2026

CVE-2022-4988Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries

Updated under an hour ago (Oct 27, 2026, 4:30 AM ET)

Does this affect you?

It affects KMX Alien::FreeImage. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for KMX Alien::FreeImage

Exploited in the last 30 days

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Alien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities such as CVE-2015-0852 and CVE-2025-65803. The library embeds other images libraries that also have known vulnerabilities.

CVSS: 7.3 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE): CWE-1395
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: CPANSec
NVD analysis: Deferred
Record last updated: May 13, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

KMX Alien::FreeImage kmx:alien_freeimage (from the name)	through 1.001	CNA record

References

References

https://freeimage.sourceforge.io/
https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source
https://nvd.nist.gov/vuln/detail/CVE-2015-0852	vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-65803	vendor-advisory
https://github.com/kmx/alien-freeimage/issues/4	issue-tracking
https://github.com/kmx/alien-freeimage/issues/5	issue-tracking

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.