Medium 6.1Published Oct 15, 2026

CVE-2026-111149FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits

Updated under an hour ago (Oct 26, 2026, 7:30 PM ET)

Does this affect you?

It affects danoli3 FreeImage and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for danoli3 FreeImage

Exploited in the last 30 days

FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.

CVSS: 6.1 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

danoli3 FreeImage danoli3:freeimage (from the name)	through 3.19.23	CNA record
FreeImage FreeImage freeimage:freeimage (from the name)	through 3.18.0	CNA record

References

References

https://hackmd.io/@haind-pwn/freeimage-pict-unpack32bits-plane-conversion-oob-read	technical-description, exploit
https://github.com/danoli3/FreeImage/blob/cc2bfc1b67d3a10e2c203c56932b09ffb52a4477/Source/FreeImage/PluginPICT.cpp#L605-L650	technical-description
https://github.com/danoli3/FreeImage	product
https://www.vulncheck.com/advisories/freeimage-through-3.19.23-heap-out-of-bounds-read-via-pict-unpack32bits	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.