← Vulnerability feed

Vulnerability record · CVE-2020-24292 · published 22 August 2023

CVE-2020-24292: Freeimage project freeimage classic buffer overflow vulnerability

Freeimage Project · Freeimage

Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted ico file.

8.8 CVSS 3.1 High EPSS 1.5% · top 27.5% CWE-120 · Classic buffer overflow
8.8CVSS 3.1 base score
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted ico file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFRQ76ZDPSWT7OH6FJDLSFW
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6GKMK74POW3RU7F4HLUJE7
https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/ Exploit
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFRQ76ZDPSWT7OH6FJDLSFW
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6GKMK74POW3RU7F4HLUJE7
https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/ Exploit

Track CVE-2020-24292 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-70968Freeimage project freeimage use after free vulnerabilityFreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().EPSS 0.51%9.8CVE-2024-31570Freeimage project freeimage out-of-bounds write vulnerabilitylibfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file.EPSS 0.61%8.8CVE-2023-47992Freeimage project freeimage integer overflow vulnerabilityAn integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a d…EPSS 0.72%8.8CVE-2023-47994Freeimage project freeimage integer overflow vulnerabilityAn integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information…EPSS 0.72%8.8CVE-2021-40263Freeimage project freeimage out-of-bounds write vulnerabilityA heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp.EPSS 1.2%8.8CVE-2021-40265Freeimage project freeimage out-of-bounds write vulnerabilityA heap overflow bug exists FreeImage before 1.18.0 via ofLoad function in PluginJPEG.cpp.EPSS 0.89%8.8CVE-2020-24293Freeimage project freeimage classic buffer overflow vulnerabilityBuffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via op…EPSS 1.5%8.8CVE-2020-24295Freeimage project freeimage classic buffer overflow vulnerabilityBuffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary code via use of …EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2020-24292), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.