---
id: CVE-2026-118752
title: FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder
summary: >-
  FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow
  vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks
  on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs
  straddling…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: danoli3
product: FreeImage
affected:
  - FreeImage < 3.19.22
  - FreeImage <= 3.18.0
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T21:11:21.485Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118752'
references:
  - url: 'https://github.com/danoli3/FreeImage/issues/156'
    label: 'GitHub Issue #156'
  - url: 'https://github.com/danoli3/FreeImage'
  - url: >-
      https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324
  - url: 'https://github.com/danoli3/FreeImage/pull/161'
  - url: >-
      https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712
  - url: >-
      https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45
  - url: 'https://github.com/danoli3/FreeImage/releases/tag/3.19.22'
    label: FreeImage 3.19.22 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder
    label: >-
      VulnCheck Advisory: FreeImage before 3.19.22 Heap Buffer Overflow via
      IFF/LBM PBM RLE Decoder
tags:
  - cve.org
epss: 0.00141
epssPercentile: 0.0342
ingestedAt: '2026-10-30T21:09:21.612Z'
---

## Overview

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.

## Affected

- `FreeImage < 3.19.22`
- `FreeImage <= 3.18.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.