CVE-2024-28582: FreeImage HDR Buffer Overflow Vulnerability

CVE-2024-28582 Overview

CVE-2024-28582 is a stack-based buffer overflow [CWE-121] in the open source FreeImage library version 3.19.0 [r1909]. The flaw resides in the rgbe_RGBEToFloat() function used when parsing High Dynamic Range (HDR) image files. A local attacker can craft a malicious HDR image that, when processed by an application linked against the vulnerable FreeImage build, triggers memory corruption and arbitrary code execution in the context of the loading process.

Critical Impact
A crafted HDR image processed by FreeImage 3.19.0 can lead to arbitrary code execution with full compromise of confidentiality, integrity, and availability of the affected process.

Affected Products

freeimage_project FreeImage 3.19.0 [r1909]
Applications and libraries statically linking the vulnerable FreeImage build
Downstream image processing tooling that invokes the HDR loader

Discovery Timeline

2024-03-20 - CVE-2024-28582 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28582

Vulnerability Analysis

The defect is a classic stack buffer overflow in the Radiance HDR image loader shipped with FreeImage. When the loader converts raw RGBE (Red-Green-Blue-Exponent) pixel data into floating-point values through rgbe_RGBEToFloat(), it copies attacker-controlled bytes from the input file into a fixed-size stack buffer without adequate bounds validation.

Because the corrupted memory sits on the call stack, an attacker can overwrite adjacent local variables, saved frame pointers, and the return address. Successful exploitation yields arbitrary code execution in the context of the user or service that invokes the library. The attack requires local file access, but no privileges or user interaction beyond opening or processing the malicious image are needed by the exploitation logic itself.

Root Cause

The root cause is missing size validation on RGBE scanline data before it is copied into a fixed-size buffer used by rgbe_RGBEToFloat(). The HDR parser trusts header-derived dimensions and per-scanline length fields from the untrusted input file, allowing an oversized or malformed scanline to write past the buffer boundary [CWE-121].

Attack Vector

Exploitation follows a local file-processing path. An attacker delivers a specially crafted HDR file to a target system through any channel that eventually feeds the file to a FreeImage-backed application, such as a converter, thumbnailer, batch renderer, or asset pipeline. When the application calls the HDR loader, the malicious scanline triggers the overflow and hijacks control flow.

A public proof-of-concept has been published in the GitHub PoC Repository, which contains sample crashing inputs demonstrating the buffer overflow condition in rgbe_RGBEToFloat().

Detection Methods for CVE-2024-28582

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking FreeImage 3.19.0 when handling .hdr files
HDR files with malformed Radiance headers or scanline length fields inconsistent with declared image dimensions
Child processes or shell activity spawned from image conversion, thumbnailer, or asset-pipeline binaries

Detection Strategies

Inventory software assets to identify binaries that statically or dynamically link FreeImage 3.19.0 [r1909]
Hunt for process crashes in image-handling utilities and correlate with recent .hdr file access
Alert on image parsers writing to executable memory regions or spawning interpreters such as sh, cmd.exe, or powershell.exe

Monitoring Recommendations

Enable kernel-level exploitation telemetry (control-flow guard, stack canary violations) for image-processing services
Monitor file ingestion points including shared folders, upload endpoints, and asset repositories for HDR files from untrusted sources
Log and review anomalous behavior from long-running batch processors that use FreeImage

How to Mitigate CVE-2024-28582

Immediate Actions Required

Identify and inventory all deployments of FreeImage 3.19.0 [r1909] across build systems and production hosts
Restrict processing of HDR files from untrusted sources until a patched build is deployed
Run image conversion workloads under least-privilege service accounts and within sandboxed environments

Patch Information

No vendor advisory URLs are listed in the NVD entry at the time of publication. Consumers of FreeImage should track upstream project activity and rebuild against a version that addresses the HDR parser bounds checks, or apply source-level fixes derived from the GitHub PoC Repository analysis.

Workarounds

Disable the HDR/Radiance plugin in FreeImage initialization if the format is not required by the application
Pre-validate HDR files with an independent parser that enforces strict header and scanline size checks before handing them to FreeImage
Isolate image parsing in a separate low-privilege process with resource limits and syscall filtering (for example, seccomp or AppContainer)

bash

# Configuration example: block untrusted HDR ingestion at the file gateway
# Reject files with the Radiance HDR signature at an upload proxy
if head -c 11 "$INPUT_FILE" | grep -q '^#?RADIANCE'; then
  echo "HDR files are not accepted from untrusted sources" >&2
  exit 1
fi