CVE-2026-111149: Out-of-bounds Read in danoli3 FreeImage
Description
FreeImage (danoli3 fork) versions up to 3.19.23 contain a heap out-of-bounds read vulnerability in the Unpack32Bits() function within PluginPICT.cpp. This occurs because the rowBytes value, controlled by the input PICT file, is not validated against the PixMap width, allowing an attacker to cause an over-read of up to 64 KiB of heap memory. This can lead to memory disclosure or application crashes when processing crafted PICT files.
CVSS v4.0
Score 6.9medium
Affected software
danoli3
FreeImage
FreeImage
FreeImage
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111149 is a heap out-of-bounds read vulnerability in FreeImage (danoli3 fork) through version 3.19.23. The flaw exists in the Unpack32Bits() function in PluginPICT.cpp, where the rowBytes parameter from a PICT file is not checked against the PixMap width. An attacker can supply a maliciously crafted PICT file with truncated or undersized rowBytes, causing the function to read beyond the allocated heap buffer by up to 64 KiB. This can result in leaking heap memory contents into decoded pixel data or cause the process to crash.
Potential Impact
Successful exploitation allows an attacker to read up to 64 KiB of heap memory beyond the intended buffer, potentially leaking sensitive information or causing application crashes. There is no indication of code execution or privilege escalation. The attack requires user interaction (opening a crafted PICT file) and local access to the vulnerable software.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted or suspicious PICT files with affected versions of FreeImage (danoli3 fork).
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-15T17:03:59.577Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad123b62cdf04f65652b703
Added to database: 10/15/2026, 19:04:22 UTC
Last enriched: 10/15/2026, 19:48:24 UTC
Last updated: 10/15/2026, 19:48:24 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.