CVE-2023-47992: High Integer Overflow in FreeImage 3.18.0

CVE-2023-47992 is a high severity (CVSS 8.8) integer overflow in FreeImage 3.18.0, in the _MemoryReadProc routine of FreeImageIO.cpp. The record says it can expose data, crash the program or allow code execution. I could not confirm a fixed version, so find your copies and stop passing untrusted images to them.

What's affected

The record names FreeImage 3.18.0 from the FreeImage project. The NVD description says an integer overflow in FreeImageIO.cpp::_MemoryReadProc allows attackers to obtain sensitive information, cause a denial of service or run arbitrary code. The weakness is CWE-190 (Integer Overflow or Wraparound).

The record scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The UI:R part means a user or a program has to open or process a crafted image file, so the realistic path is an application that accepts images from outside, such as an upload form, an email attachment viewer or a conversion service.

The only reference is a repository from the person who reported the issue. I did not find a vendor advisory, a release note naming a fixed version or a distribution bulletin in the sources I checked, so I cannot name one here. Check your operating system vendor and the project before you assume a patch exists. The record does not flag the CVE as exploited in the wild.

How to check if you're exposed

FreeImage is a C and C++ library, so it is often compiled into another program or shipped as a shared library by your operating system. Look for it in several places.

dpkg -l | grep -i freeimage
rpm -qa | grep -i freeimage
ldconfig -p | grep -i freeimage
brew list --versions freeimage

The first two cover Debian and Red Hat family package managers, the third lists shared libraries the loader knows about, and the last covers Homebrew. Statically linked copies will not show up this way, so also search your source trees and vendored folders for a FreeImage directory, and check software bills of materials where you have them.

For container images, run the same package queries inside the image, or scan the image with a tool that reads package metadata. Version 3.18.0 is the one named in the record.

What to do now

1. Inventory every product and image that bundles FreeImage, including statically linked copies and vendored source folders.
2. Check the FreeImage project and your operating system vendor for a fixed release or a patch, since I could not confirm one from the record.
3. Stop passing untrusted image files to FreeImage where you can. Convert or validate uploads in a sandboxed process instead.
4. Run image decoding in a low privilege, resource limited process so that a crash or memory error stays contained.
5. Plan a move to a maintained image library if no patched FreeImage release is available for your platform.

Why it matters

An integer overflow occurs when arithmetic on a size or length wraps around to a small number. Code that then allocates a buffer from that number, and copies far more data into it, writes past the end of the buffer. Image parsers are a common home for this bug because file headers carry sizes that the parser must trust to some degree.

The memory read routine in question is the code that lets the library read an image from a block of memory rather than from a file, which is how many server side programs use it. That makes the library a poor fit for untrusted input unless it runs in a contained process. Reachability analysis helps here, because it tells you whether your code actually calls the affected library on data an outsider controls. See the Safeguard Gold page for this CVE for the record.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Researcher repository referenced by the NVD record (FreeImage-cve-poc)
• NVD record for CVE-2023-47992

Last reviewed: 19 October 2026.