FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.19.25
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FreeImage, a C/C++ image library (danoli3 fork), is affected when it loads GIF files with the GIF_PLAYBACK option. A specially crafted GIF with a frame rectangle extending beyond the logical screen width can corrupt heap memory, which may lead to a crash or potentially allow arbitrary code execution.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- danoli3 FreeImage
fixed in 3.19.25
- FreeImage FreeImage
through 3.18.0