{"id":"CVE-2026-111149","summary":"FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits","details":"FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.","modified":"2026-10-17T02:48:20.596945785Z","published":"2026-10-15T18:57:38.810Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111149.json","cna_assigner":"VulnCheck"},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111149.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111149"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/freeimage-through-3.19.23-heap-out-of-bounds-read-via-pict-unpack32bits"},{"type":"PACKAGE","url":"https://github.com/danoli3/FreeImage"},{"type":"ARTICLE","url":"https://github.com/danoli3/FreeImage/blob/cc2bfc1b67d3a10e2c203c56932b09ffb52a4477/Source/FreeImage/PluginPICT.cpp#L605-L650"},{"type":"EVIDENCE","url":"https://hackmd.io/@haind-pwn/freeimage-pict-unpack32bits-plane-conversion-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/danoli3/freeimage","events":[{"introduced":"0"},{"fixed":"cc2bfc1b67d3a10e2c203c56932b09ffb52a4477"}],"database_specific":{"source":"DESCRIPTION","extracted_events":[{"introduced":"0"},{"fixed":"3.19.23"}]}}],"versions":["3.19.22","3.19.21","3.19.20","3.19.19","3.19.18","3.19.17","3.19.16","3.19.15","3.19.14","3.19.13","3.19.12","3.19.11","3.19.10","3.19.9","3.19.8","3.19.7","3.19.6","3.19.5","3.19.4","3.19.3","3.19.2","3.18.10","3.18.9","3.18.8","3.18.7","3.18.6","3.18.5","3.18.4","3.18.3","3.18.2","3.18.1","3.18.0","3.16.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111149.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}