CVE-2026-118752 — Vulnerability intelligence
—
Published:
- CVSS
- 8.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.