Freeimage Project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-70968 FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().Critical 9.8 · Jan 14, 2026
• CVE-2024-9029 A flaw was found in the freeimage library.High 7.5 · Sep 27, 2024
• CVE-2024-31570 libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file.Critical 9.8 · Sep 19, 2024
• CVE-2024-28583 Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the readLine() function when readiHigh 7.8 · Mar 20, 2024
• CVE-2024-28582 Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the rgbe_RGBEToFloat() function whHigh 8.4 · Mar 20, 2024
• CVE-2024-28581 Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the _assignPixel<>() function whenHigh 8.4 · Mar 20, 2024
• CVE-2024-28580 Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the ReadData() function when readiHigh 8.4 · Mar 20, 2024
• CVE-2024-28578 Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Load() function when reading iHigh 8.4 · Mar 20, 2024
• CVE-2024-28569 Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf_2_2::Xdr::read() function High 7.8 · Mar 20, 2024
• CVE-2024-28566 Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the AssignPixel() function when reHigh 8.4 · Mar 20, 2024
• CVE-2023-47994 An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a dHigh 8.8 · Jan 9, 2024
• CVE-2023-47992 An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-seHigh 8.8 · Jan 9, 2024
• CVE-2021-40265 A heap overflow bug exists FreeImage before 1.18.0 via ofLoad function in PluginJPEG.cpp.High 8.8 · Aug 22, 2023
• CVE-2021-40263 A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp.High 8.8 · Aug 22, 2023
• CVE-2020-24295 Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary code via use of crafted psdHigh 8.8 · Aug 22, 2023
• CVE-2020-24293 Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crHigh 8.8 · Aug 22, 2023
• CVE-2020-24292 Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of craftedHigh 8.8 · Aug 22, 2023
• CVE-2020-21428 Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts viaHigh 7.8 · Aug 22, 2023
• CVE-2020-21427 Buffer Overflow vulnerability in function LoadPixelDataRLE8 in PluginBMP.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other iHigh 7.8 · Aug 22, 2023
• CVE-2020-21426 Buffer Overflow vulnerability in function C_IStream::read in PluginEXR.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impHigh 7.8 · Aug 22, 2023
• CVE-2019-12214 In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3 function in j2k.c.High 7.5 · May 20, 2019
• CVE-2019-12212 When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, evenHigh 7.5 · May 20, 2019
• CVE-2019-12211 When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the destination addressHigh 7.5 · May 20, 2019