CVE-2024-28566 Overview
CVE-2024-28566 is a stack-based buffer overflow [CWE-121] in the open source FreeImage library version 3.19.0 [r1909]. The flaw resides in the AssignPixel() function invoked while parsing images in the Tagged Image File Format (TIFF). A local attacker who supplies a crafted TIFF file can trigger memory corruption and execute arbitrary code in the context of the process using the library. FreeImage is widely embedded in image-processing pipelines, converters, and desktop applications, which broadens the exposure surface for this issue.
Critical Impact
A crafted TIFF file processed by AssignPixel() allows local arbitrary code execution with full confidentiality, integrity, and availability impact.
Affected Products
- FreeImage 3.19.0 [r1909]
- Applications statically or dynamically linking libfreeimage 3.19.0
- Third-party tools embedding the vulnerable FreeImage TIFF decoder
Discovery Timeline
- 2024-03-20 - CVE-2024-28566 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-28566
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow [CWE-121] within the AssignPixel() helper function used by FreeImage during TIFF decoding. AssignPixel() copies pixel data between buffers based on the color depth and channel layout declared in the TIFF header. When the declared pixel size exceeds the destination buffer, the copy operation overwrites adjacent stack memory. An attacker who controls the TIFF header fields can shape the overflow to corrupt saved return addresses or function pointers. Successful exploitation yields arbitrary code execution in the process that loaded the malicious image.
Root Cause
The root cause is missing bounds validation between the attacker-controlled pixel descriptor in the TIFF file and the fixed-size destination buffer used by AssignPixel(). FreeImage trusts the width, height, and bits-per-sample fields from the TIFF Image File Directory (IFD) without cross-checking them against the allocated pixel row. Additional details are available in the GitHub vulnerability report repository.
Attack Vector
Exploitation requires local delivery of a malicious TIFF file to an application that uses FreeImage 3.19.0 to decode it. The attacker does not need authentication or user interaction beyond opening the file with a vulnerable viewer, converter, or batch processor. Server-side image processing tools that ingest user-supplied TIFF files broaden the reachable attack surface. The vulnerability affects confidentiality, integrity, and availability of the host process.
No verified proof-of-concept code is published in the enriched data. See the vulnerability report repository for reproduction artifacts.
Detection Methods for CVE-2024-28566
Indicators of Compromise
- Unexpected crashes or segmentation faults in processes linked against libfreeimage when handling TIFF files
- TIFF files with anomalous BitsPerSample, SamplesPerPixel, or ImageWidth values inconsistent with the declared strip size
- Child processes or shell activity spawned by image-processing applications shortly after TIFF ingestion
Detection Strategies
- Perform software composition analysis (SCA) to enumerate binaries that statically or dynamically link FreeImage 3.19.0 [r1909]
- Instrument TIFF-processing services with AddressSanitizer or equivalent runtime memory-safety tooling in test environments
- Alert on anomalous process lineage where an image viewer or converter spawns interpreters, shells, or network utilities
Monitoring Recommendations
- Log file-open events for TIFF assets in image-processing pipelines and correlate with subsequent process crashes
- Monitor endpoint telemetry for unexpected memory access violations in applications known to use FreeImage
- Track file-format submissions to shared conversion services and flag TIFF payloads with malformed IFD entries
How to Mitigate CVE-2024-28566
Immediate Actions Required
- Inventory all applications and services embedding FreeImage 3.19.0 [r1909] and identify TIFF-processing exposure
- Restrict acceptance of untrusted TIFF files in server-side image pipelines until a patched build is deployed
- Isolate TIFF-processing workloads inside sandboxes or containers with reduced filesystem and network privileges
Patch Information
No vendor patch reference is included in the NVD entry for CVE-2024-28566 at the time of publication. Consult the FreeImage project source repository for the latest revision beyond r1909 and rebuild dependent applications once a fix is available. Track the GitHub vulnerability report for updates on remediation status.
Workarounds
- Disable TIFF decoding in FreeImage-based applications where the format is not required
- Route TIFF processing through a hardened converter such as libtiff with current security fixes before handing data to FreeImage
- Enforce operating-system exploit mitigations including ASLR, DEP/NX, and stack canaries on processes that load FreeImage
# Configuration example: sandbox a FreeImage-based converter with firejail
firejail --noprofile --net=none --private-tmp --read-only=/usr \
--caps.drop=all --seccomp --nonewprivs \
/usr/local/bin/image-converter --input /tmp/untrusted.tiff --output /tmp/out.png
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
