CVE-2026-111149

MediumCVSS 6.1/10Last modified Oct 16, 2026

Description

FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-111157.3Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalatiCVE-2026-1111505.5ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an uCVE-2026-1111516.1OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt CVE-2026-1111525.5Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integCVE-2026-1111535.5Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers CVE-2026-1111546.1libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack CVE-2026-1111556.1libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated saCVE-2026-1111566.1libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corruCVE-2026-1111576.1SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd saCVE-2026-1111585.5EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncatedCVE-2026-1111596.1libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name anCVE-2026-111168.8Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious netwo