Every CVE Search/ Get API key

CVE-2020-21428

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows...

7.8 HighFix available

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.46%Up 0.4 points since Aug 23, 2023
90%50%10%1%

What each source reports

NVD Score used 7.8

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.

Record
CVE-2020-21428
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-120
Updated
2026-11-02
CVE List 3.3

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.

Record
CVE-2020-21428
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2020-14200 3.3

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.

Record
EUVD-2020-14200
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5qcr-q6p5-3jp9 7.8

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows...

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.

Record
GHSA-5qcr-q6p5-3jp9
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-02
OSV 7.8

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.

Record
CVE-2020-21428
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-21428 7.8

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.

Record
DEBIAN-CVE-2020-21428
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVOESA-2023-1898 7.8

freeimage security update

FreeImage is a library project for developers who would like to support popular graphics image formats (PNG, JPEG, TIFF, BMP and others). Some highlights are: extremely simple in use, not limited to the local PC (unique FreeImageIO) and Plugin driven!

Security Fix(es):

Buffer Overflow vulnerability in function LoadPixelDataRLE8 in PluginBMP.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.(CVE-2020-21427)

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.(CVE-2020-21428)

Record
OESA-2023-1898
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-21428 7.8

Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.

Record
UBUNTU-CVE-2020-21428
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:13293-1 No score

freeimage-devel-3.18.0.1909-1.1 on GA media

These are all security issues fixed in the freeimage-devel-3.18.0.1909-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13293-1
Updated
2026-11-02
OSVUSN-6586-1 No score

freeimage vulnerabilities

It was discovered that FreeImage incorrectly handled certain memory operations. If a user were tricked into opening a crafted TIFF file, a remote attacker could use this issue to cause a heap buffer overflow, resulting in a denial of service attack. This issue only affected Ubuntu 16.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-12211)

It was discovered that FreeImage incorrectly processed images under certain circumstances. If a user were tricked into opening a crafted TIFF file, a remote attacker could possibly use this issue to cause a stack exhaustion condition, resulting in a denial of service attack. This issue only affected Ubuntu 16.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-12213)

It was discovered that FreeImage incorrectly processed certain images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2020-21427, CVE-2020-21428)

It was discovered that FreeImage incorrectly processed certain images. If a user or automated system were tricked into opening a specially crafted PFM file, an attacker could possibly use this issue to cause a denial of service. (CVE-2020-22524)

Record
USN-6586-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freeimage
Debian:12
 before 3.18.0+ds2-9+deb12u1, plus listed versions
3.18.0+ds2-9
3.18.0+ds2-9+deb12u1
freeimage
Debian:13
 before 3.18.0+ds2-10
3.18.0+ds2-10
freeimage
Debian:10
 before 3.18.0+ds2-1+deb10u2, plus listed versions
3.18.0+ds2-13.18.0+ds2-1+deb10u1
3.18.0+ds2-1+deb10u2
freeimage
Debian:11
 before 3.18.0+ds2-6+deb11u1, plus listed versions
3.18.0+ds2-6
3.18.0+ds2-6+deb11u1
freeimage
openEuler:20.03-LTS-SP1
 before 3.18.0-5.oe1
3.18.0-5.oe1
freeimage
openEuler:20.03-LTS-SP3
 before 3.18.0-5.oe1
3.18.0-5.oe1
freeimage
openEuler:22.03-LTS
 before 3.18.0-9.oe2203sp2
3.18.0-9.oe2203sp2
freeimage
openEuler:22.03-LTS-SP1
 before 3.18.0-9.oe2203sp1
3.18.0-9.oe2203sp1
freeimage
openEuler:22.03-LTS-SP2
 before 3.18.0-9.oe2203sp2
3.18.0-9.oe2203sp2
freeimage
Ubuntu:Pro:14.04:LTS
 before 3.15.4-3ubuntu0.1+esm3, plus listed versions
3.15.1-2build13.15.1-2build23.15.4-23.15.4-33.15.4-3ubuntu0.13.15.4-3ubuntu0.1+esm13.15.4-3ubuntu0.1+esm2
3.15.4-3ubuntu0.1+esm3
Show 6 moreShow less
Affected packages
PackageAffectedFixed
freeimage
Ubuntu:Pro:16.04:LTS
 before 3.17.0+ds1-2ubuntu0.1+esm1, plus listed versions
3.15.4-4.1build13.15.4-63.17.0+ds1-1.13.17.0+ds1-23.17.0+ds1-2ubuntu0.1
3.17.0+ds1-2ubuntu0.1+esm1
freeimage
Ubuntu:Pro:18.04:LTS
 before 3.17.0+ds1-5+deb9u1ubuntu0.1~esm1, plus listed versions
3.17.0+ds1-5build23.17.0+ds1-5+deb9u1build0.18.04.1
3.17.0+ds1-5+deb9u1ubuntu0.1~esm1
freeimage
Ubuntu:20.04:LTS
 before 3.18.0+ds2-1ubuntu3.1, plus listed versions
3.18.0+ds2-1ubuntu13.18.0+ds2-1ubuntu23.18.0+ds2-1ubuntu3
3.18.0+ds2-1ubuntu3.1
freeimage
Ubuntu:22.04:LTS
 before 3.18.0+ds2-6ubuntu5.1, plus listed versions
3.18.0+ds2-6ubuntu33.18.0+ds2-6ubuntu43.18.0+ds2-6ubuntu5
3.18.0+ds2-6ubuntu5.1
freeimage
Ubuntu:24.04:LTS
 before 3.18.0+ds2-10build4, plus listed versions
3.18.0+ds2-9.13.18.0+ds2-103.18.0+ds2-10build23.18.0+ds2-10build3
3.18.0+ds2-10build4
freeimage
openSUSE:Tumbleweed
 before 3.18.0.1909-1.1
3.18.0.1909-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-21428 is a high vulnerability (CVSS 7.8) in Freeimage Project Freeimage, published August 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in freeimage 3.18.0+ds2-9+deb12u1.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open