FreeImage CVE-2026-118752

Exploitation requires an application built on the danoli3 FreeImage fork (before 3.19.22) to decode an attacker-supplied IFF/LBM image that uses the PBM ByteRun1 RLE compression path, with RLE runs deliberately constructed to straddle scanline ends so the run copy overruns the heap-allocated bitmap. The victim must open or process the file - UI:P / passive user interaction - and the vector is local (AV:L), so there is no remote unauthenticated path; no authentication is required (PR:N). Limiting factors: the attacker needs the target application to actually route untrusted images through this specific IFF PBM decoder, and the overflow is bounded to roughly 127 bytes of controlled data past the allocation, so reliable code execution depends on heap layout; applications that only process trusted images are not realistically exposed.

The CVSS 4.0 vector (8.5) is driven by the triple-high impact (VC:H/VI:H/VA:H) of a 127-byte controlled heap out-of-bounds write (CWE-787), but the exploitability metrics temper real-world urgency: AV:L means there is no network vector - an attacker cannot reach this remotely and must get a crafted file onto the system - and UI:P (passive user interaction) means a victim must open or process the malicious IFF/LBM PBM file in an application using this library. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no quantitative or confirmed signal of active exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-under-active-attack posture: a genuine memory-corruption bug worth patching promptly, but not a drop-everything internet-facing emergency. The dominant risk driver is how the affected software is deployed - if it silently decodes untrusted user-supplied images (thumbnailers, upload pipelines, viewers), the UI:P barrier is effectively met routinely and risk rises accordingly; in deployments that only process trusted local files, practical risk is lower. The source diff confirms the mechanism (missing bounds check on bytes written versus scanline length in the ByteRun1 RLE path), so this is a well-substantiated defect rather than a speculative high-CVSS entry.

An attacker crafts a malicious IFF/LBM image containing PBM ByteRun1 RLE runs that straddle scanline boundaries and delivers it to a victim (email attachment, upload, or a file opened by an application that uses the danoli3 FreeImage fork). When the victim's application decodes the image, the unbounded run copy writes up to 127 attacker-controlled bytes past the heap-allocated bitmap, corrupting adjacent heap memory. No public exploit identified at time of analysis; exploitation requires the victim to open/process the file (UI:P) and there is no remote network vector.