CVE-2026-111149 — FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-…
Published: 2026-10-15 · CVSS: 6.9 · CVSS 4.0
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7