Is CVE-2026-111149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111149 being exploited in the wild.

How severe is CVE-2026-111149?

Medium severity, with a CVSS score of 6.1, published 15 October 2026.

Which products and versions are affected?

Danoli3 FreeImage through 3.19.23.

Is there a fix for CVE-2026-111149?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111149 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111149?

Check whether you run Danoli3 FreeImage at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111149: FreeImage heap out-of-bounds read in PICT parsing

CVE-2026-111149 · Severity: medium · CVSS 6.1 · Published 2026-10-15

FreeImage is a library for loading and manipulating image files. A heap out-of-bounds read vulnerability in PICT file parsing allows an attacker to supply a crafted PICT file that reads up to 64 KiB of heap memory, potentially leaking sensitive data or crashing applications that use the library.

Technologies: Danoli3 FreeImage. Vendors: Danoli3.

Quick answers

Is CVE-2026-111149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111149 being exploited in the wild.
How severe is CVE-2026-111149?: Medium severity, with a CVSS score of 6.1, published 15 October 2026.
Which products and versions are affected?: Danoli3 FreeImage through 3.19.23.
Is there a fix for CVE-2026-111149?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111149 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111149?: Check whether you run Danoli3 FreeImage at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Unpack32Bits() function in PluginPICT.cpp, where the rowBytes field from a PICT file's PixMap is never validated against the file-controlled width value. An attacker can craft a PICT file with a truncated or undersized rowBytes field to trigger an out-of-bounds heap read. Exploitation requires a user to open a malicious PICT file.

Affected products

danoli3 FreeImage through 3.19.23

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.