Description
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| danoli3 | FreeImage | < 3.19.25 | 3.19.25 |
| FreeImage | FreeImage | ≤ 3.18.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | freeimage | No fix yet | — |
| Ubuntu 26.04 LTS | freeimage | No fix yet | — |
| Ubuntu 24.04 LTS | freeimage | No fix yet | — |
| Ubuntu 22.04 LTS | freeimage | No fix yet | — |
| Ubuntu 20.04 LTS | freeimage | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | freeimage | No fix yet | — |
| Ubuntu Pro 16.04 LTS | freeimage | No fix yet | — |
| Ubuntu Pro 14.04 LTS | freeimage | No fix yet | — |
References
- Pull Request #183 issue-tracking patch
- Patch Commit patch
- https://github.com/danoli3/FreeImage product
- https://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772 technical-description
- https://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034 patch
- FreeImage 3.19.25 Release Notes release-notes
- Changelog naming CVE-2026-118752 and CVE-2026-118753 release-notes
- https://sourceforge.net/projects/freeimage/ product
- VulnCheck Advisory: FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing third-party-advisory