FreeImage CVE-2026-118753

Exploitation requires the consuming application to load an attacker-supplied GIF via FreeImage's animated-playback path, i.e. with the GIF_PLAYBACK flag set; the crafted GIF must contain a frame whose left offset plus width exceeds the logical screen width (e.g. a frame beginning at or beyond the canvas edge), which drives the unclipped write in GifPlaybackCompositeFrame() and GifPlaybackFillRect(). Limiting factors that reduce real-world reach: the vulnerable compositing code is only reached when GIF_PLAYBACK is used, not during plain single-frame GIF decoding; the attack vector is local (AV:L) and needs the victim to open the file (UI:P, passive interaction); and only the danoli3 FreeImage fork before 3.19.25 is affected - updating to 3.19.25 is the vendor-provided fix.

Signals point to a genuine but conditional memory-corruption flaw rather than an internet-wide emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VC:H/VI:H/VA:H) scores 8.5 and reflects a local attack vector requiring passive user interaction with full confidentiality/integrity/availability impact on the vulnerable system - consistent with a client-side image-parsing bug (CWE-787 out-of-bounds write) reached by opening a crafted file, not a remotely sprayable network service. There is no KEV listing and no EPSS score in the input, so active-exploitation and statistical-exploitation signals are simply absent (not low - missing); do not read that absence as safety. The vuln.today Decision label is 'this_week' (not act_now/emergency), which aligns with high technical impact tempered by the local vector and the requirement that the application actually use the GIF_PLAYBACK code path. A vendor patch exists (PR #183, release 3.19.25) and the root cause is confirmed by the diff. Bottom line: a real priority for any product that loads untrusted animated GIFs through the danoli3 FreeImage fork with GIF_PLAYBACK, but its reach is gated by local file delivery plus that specific loading mode, so it is a patch-this-week item rather than a drop-everything network-wormable issue.

An attacker crafts an animated GIF whose frame left offset plus width exceeds the logical screen width and delivers it to a victim who opens it in an application that loads GIFs through the danoli3 FreeImage fork with the GIF_PLAYBACK flag. During playback compositing, GifPlaybackCompositeFrame() and GifPlaybackFillRect() write past the canvas heap allocation, corrupting adjacent heap memory with attacker-influenced data and potentially leading to code execution. The regression test added in PR #183 (testGifPlaybackBounds.cpp) programmatically builds such an out-of-bounds GIF, so a public PoC reference exists; it is not verified as working weaponized exploit code.