CVE-2026-111149
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
39/100
Published: 2026-10-15
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Passive
AT:
None
VC:
Low
VI:
None
VA:
High
Description
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.