CVE-2026-111149: danoli3 freeimage Out-of-bounds Read

Vulnerability summary

CVE-2026-111149 is a medium (CVSS 6.9) Out-of-bounds Read vulnerability in danoli3 freeimage. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-10-2026
   PublishedVulnerability first disclosed.

Description

FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.