Heap Out-of-Bounds Read in FreeImage (danoli3 fork)

Executive Summary

This is a heap out-of-bounds read vulnerability in FreeImage's PICT image decoder. The Unpack32Bits() function in PluginPICT.cpp fails to validate the rowBytes value against the PixMap width controlled by a maliciously crafted PICT file. Attackers can trigger an over-read of up to 64 KiB of heap memory, potentially leaking sensitive data or crashing the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using FreeImage (danoli3 fork) version 3.19.23 or earlier. Check for crashes or memory leaks when processing PICT files. Use static analysis tools to examine PluginPICT.cpp for missing rowBytes validation against PixMap width.

Useful 0 Not Useful 0

Impact Analysis

If you process untrusted PICT files with vulnerable FreeImage versions, this flaw could allow attackers to read sensitive memory contents or cause denial-of-service by crashing the application. The impact depends on how FreeImage is used in your environment.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeImage to the latest version from the danoli3 fork. Disable processing of PICT files if not required. Implement input validation for rowBytes and PixMap width in image processing pipelines. Monitor for crashes or memory corruption when handling PICT files.

Useful 0 Not Useful 0