CVE-2020-24293
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859]...
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
- Record
CVE-2020-24293- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List No score
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
- Record
CVE-2020-24293- Updated
- 2026-11-02
EUVDEUVD-2020-17028 No score
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
- Record
EUVD-2020-17028- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3r68-3m37-942g
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859]...
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
- Record
GHSA-3r68-3m37-942g- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSV
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
- Record
CVE-2020-24293- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-24293
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
- Record
DEBIAN-CVE-2020-24293- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2305
freeimage security update
FreeImage is a library project for developers who would like to support popular graphics image formats (PNG, JPEG, TIFF, BMP and others). Some highlights are: extremely simple in use, not limited to the local PC (unique FreeImageIO) and Plugin driven!
Security Fix(es):
Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted ico file.(CVE-2020-24292)
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.(CVE-2020-24293)
Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary code via use of crafted psd file.(CVE-2020-24295)
Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file.(CVE-2021-33367)
A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp.(CVE-2021-40263)
FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is vulnerabile to null pointer dereference.(CVE-2021-40266)
Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.(CVE-2023-47995)
An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service.(CVE-2023-47997)
- Record
OESA-2024-2305- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-24293
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.
- Record
UBUNTU-CVE-2020-24293- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freeimageDebian:12 |
All versions, plus listed versions 3.18.0+ds2-103.18.0+ds2-113.18.0+ds2-93.18.0+ds2-9+deb12u13.18.0+ds2-9.14.2.1+ds-1~exp14.2.1+ds-1~exp24.2.1+ds-1~exp3 |
None known |
freeimageDebian:13 |
All versions, plus listed versions 3.18.0+ds2-114.2.1+ds-1~exp14.2.1+ds-1~exp24.2.1+ds-1~exp3 |
None known |
freeimageopenEuler:20.03-LTS-SP4 |
before 3.18.0-7.oe2003sp4 | 3.18.0-7.oe2003sp4 |
freeimageopenEuler:22.03-LTS-SP1 |
before 3.18.0-11.oe2203sp1 | 3.18.0-11.oe2203sp1 |
freeimageopenEuler:24.03-LTS |
before 3.18.0-13.oe2403 | 3.18.0-13.oe2403 |
freeimageopenEuler:22.03-LTS-SP4 |
before 3.18.0-11.oe2203sp4 | 3.18.0-11.oe2203sp4 |
freeimageopenEuler:22.03-LTS-SP3 |
before 3.18.0-11.oe2203sp3 | 3.18.0-11.oe2203sp3 |
freeimageUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.15.1-2build13.15.1-2build23.15.4-23.15.4-33.15.4-3ubuntu0.13.15.4-3ubuntu0.1+esm13.15.4-3ubuntu0.1+esm23.15.4-3ubuntu0.1+esm3 |
None known |
freeimageUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.15.4-4.1build13.15.4-63.17.0+ds1-1.13.17.0+ds1-23.17.0+ds1-2ubuntu0.13.17.0+ds1-2ubuntu0.1+esm1 |
None known |
freeimageUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.17.0+ds1-5build23.17.0+ds1-5+deb9u1build0.18.04.13.17.0+ds1-5+deb9u1ubuntu0.1~esm1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
freeimageUbuntu:20.04:LTS |
All versions, plus listed versions 3.18.0+ds2-1ubuntu13.18.0+ds2-1ubuntu23.18.0+ds2-1ubuntu33.18.0+ds2-1ubuntu3.1 |
None known |
freeimageUbuntu:22.04:LTS |
All versions, plus listed versions 3.18.0+ds2-6ubuntu33.18.0+ds2-6ubuntu43.18.0+ds2-6ubuntu53.18.0+ds2-6ubuntu5.1 |
None known |
freeimageUbuntu:24.04:LTS |
All versions, plus listed versions 3.18.0+ds2-9.13.18.0+ds2-103.18.0+ds2-10build23.18.0+ds2-10build33.18.0+ds2-10build4 |
None known |
freeimageUbuntu:25.10 |
All versions, plus listed versions 3.18.0+ds2-11 |
None known |
freeimageUbuntu:26.10 |
All versions, plus listed versions 3.18.0+ds2-11build13.18.0+ds2-11build23.18.0+ds2-11build3 |
None known |
freeimageUbuntu:26.04:LTS |
All versions, plus listed versions 3.18.0+ds2-113.18.0+ds2-11build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24293 is a high vulnerability (CVSS 8.8) in Freeimage Project Freeimage, published August 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. Fixed in freeimage 3.18.0-7.oe2003sp4.
References
sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6GKMK74POW3RU7F4HLUJE7XEFLQDO35
nvd.nist.gov/vuln/detail/CVE-2020-24293
Show 12 moreShow less
github.com/advisories/GHSA-3r68-3m37-942g
security-tracker.debian.org/tracker/CVE-2020-24293
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2305
ubuntu.com/security/CVE-2020-24293
cve.org/CVERecord?id=CVE-2020-24293