High severity · published Oct 28, 2026
CVE-2026-118753
FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing
New
7.8
CVSS
–
EPSS
No
On KEV
Description
FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
FreeImage · danoli3
before 3.19.25 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118753
github.com
https://github.com/danoli3/FreeImage
github.com
https://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772
github.com
https://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034
github.com
https://github.com/danoli3/FreeImage/commit/96f4099f8e307484ba69b4aa14d772b7679a1bfb
github.com
https://github.com/danoli3/FreeImage/pull/183
github.com
https://github.com/danoli3/FreeImage/releases/tag/3.19.25
More from FreeImage
7.8
CVE-2026-118752
FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder
6.1
CVE-2026-111149
FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits