Live › vulnerability › CVE-2026-118753
Go to dashboardThe danoli3 fork of FreeImage does not clip GIF frame rectangles to the logical screen size in PluginGIF.cpp. A crafted GIF whose frame extends past the canvas makes the playback compositing code write beyond the canvas heap allocation when it is loaded with GIF_PLAYBACK.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Applications that embed the danoli3 FreeImage fork before 3.19.25 and decode GIF files from untrusted sources with the GIF_PLAYBACK flag. Systems that only decode trusted local images, or that use upstream FreeImage builds rather than this fork, can skip it.
No product ranges from the sources yet.
grep -ri freeimage in the build files or package manifestGIF_PLAYBACK flag in the FreeImage_Load call sites3.19.25 or laterGIF_PLAYBACKEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.
This page as .md · .json · in your agent: get_signal("CVE-2026-118753")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.