High 7.8Published Oct 28, 2026

CVE-2026-118752FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder

Updated under an hour ago (Oct 29, 2026, 12:00 PM ET)

Does this affect you?

It affects danoli3 FreeImage and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for danoli3 FreeImage

Exploited in the last 30 days

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 28, 2026
First seen by InfoSec Signals: Oct 28, 2026

Affected products

Affected products

danoli3 FreeImage danoli3:freeimage (from the name)	before 3.19.22	CNA record
FreeImage FreeImage freeimage:freeimage (from the name)	through 3.18.0	CNA record

References

References

https://github.com/danoli3/FreeImage/issues/156	issue-tracking
https://github.com/danoli3/FreeImage	product
https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324	technical-description
https://github.com/danoli3/FreeImage/pull/161	patch, issue-tracking
https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712	patch
https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45	patch
https://github.com/danoli3/FreeImage/releases/tag/3.19.22	release-notes
https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.