FreeImage CVE-2026-111149

Exploitation requires an application that links the danoli3 FreeImage fork (through 3.19.23) to load and decode an attacker-supplied PICT file whose PixMap specifies a rowBytes value smaller than the file-controlled width, reaching the Unpack32Bits() 32-bit plane-conversion path. Key LIMITING factors: the vector is LOCAL (AV:L) and requires passive user interaction (UI:P) - a victim must open or process the malicious file; there is no network-facing or unauthenticated path. The target application must support/attempt PICT decoding, and impact is bounded to heap over-read (information disclosure of up to 64 KiB and/or crash), not code execution.

This is a moderate-risk, client-side memory-safety flaw rather than a high-priority remote threat. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) describes a LOCAL attack requiring passive user interaction (a victim must open or process a malicious file), yielding low confidentiality impact (a bounded heap over-read leaking memory into decoded pixels) and high availability impact (process crash). This is internally consistent with the CWE-125 (out-of-bounds read) classification and the description. Publicly available exploit code exists (per VulnCheck advisory and the hackmd write-up), which raises practical risk, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists', which must not be conflated with in-the-wild use. No conflicting signals were found: the LOCAL vector and user-interaction requirement correctly reflect a library that parses attacker-supplied files, so the realistic worst case is information disclosure of adjacent heap contents (up to 64 KiB) or denial of service, not remote code execution. Net: a legitimate issue to patch in software bundling the affected fork, but not an emergency.

An attacker crafts a malicious PICT image with a truncated or undersized rowBytes value relative to the file-controlled PixMap width, then delivers it to a victim who opens it in an application that uses the danoli3 FreeImage fork (≤3.19.23). When Unpack32Bits() in PluginPICT.cpp decodes the image, it over-reads up to 64 KiB of adjacent heap memory, leaking that data into the decoded pixels or crashing the process. Public proof-of-concept exploit code is available via the VulnCheck advisory and an associated hackmd write-up.