CVE-2025-65803: 
Homebrew vulnerability analysis and mitigation

CVE-2025-65803 is an integer overflow vulnerability in the psdParser::ReadImageData function of the FreeImage library, versions 3.18.0 and earlier, that allows attackers to cause a Denial of Service (DoS) via a crafted PSD file. The vulnerability was published on December 10, 2025, and assigned by MITRE. It carries a CVSS v3.1 base score of 6.5 (Medium), requiring no privileges but user interaction to trigger (Feedly, PoC Gist).

The root cause is an integer overflow (CWE-190) combined with uncontrolled resource consumption (CWE-400) in the psdParser::ReadImageData function. The parser computes lineSize = width * (depth / 8) directly from PSD header fields without validating that depth is a legitimate value (e.g., 1, 8, or 16). An attacker supplying an abnormally large depth value causes lineSize to become extremely large; when nCompression is set to NONE, the parser then executes memcpy(dst_line_start, src, lineSize), overflowing the destination bitmap row buffer (which was allocated based on expected bit-depth, e.g., ~80 bytes) and triggering a heap-buffer-overflow crash. A proof-of-concept demonstrating the trigger conditions is publicly available (PoC Gist).

Successful exploitation causes a heap-buffer-overflow in any application that uses FreeImage to process PSD files, resulting in a crash and Denial of Service. While the primary confirmed impact is availability loss, the heap-buffer-overflow nature of the bug introduces potential for memory corruption, which could theoretically be leveraged for further exploitation in some environments. Any service or application that accepts and processes user-supplied PSD images using FreeImage ≤ 3.18.0 is at risk (PoC Gist, Feedly).

A public proof-of-concept exploit is available on GitHub, published by researcher 1mxml on December 11, 2025 (PoC Gist). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.034%, reflecting low near-term exploitation probability. Exploitation requires user interaction — specifically, an application must be induced to open a malicious PSD file (Feedly).

1. Craft a malicious PSD file: Create a PSD file with a malformed header containing an abnormally large depth field (e.g., a value far exceeding valid options of 1, 8, or 16) and set nCompression to NONE (raw pixel data mode).
2. Deliver the file to the target: Trick a user or automated pipeline into opening the crafted PSD file with an application that uses FreeImage ≤ 3.18.0 for image processing (e.g., via email attachment, web upload, or shared storage).
3. Trigger parsing: The application calls FreeImage_Load() on the malicious PSD file, invoking psdParser::ReadImageData.
4. Integer overflow occurs: The parser computes lineSize = width * (depth / 8) using the attacker-controlled depth value, producing an extremely large lineSize without bounds checking.
5. Heap-buffer-overflow: The parser executes memcpy(dst_line_start, src, lineSize), writing far beyond the allocated destination buffer, causing a crash (DoS) and potential memory corruption (PoC Gist).

• File System: Presence of PSD files with unusually large or invalid depth header values (outside 1, 8, 16) in upload directories, temp folders, or image processing queues.
• Logs: Application crash logs or core dumps referencing psdParser::ReadImageData or FreeImage_Load; heap corruption error messages from memory allocators.
• Process: Unexpected termination (segfault/SIGABRT) of image-processing services or applications immediately after opening a PSD file; address sanitizer (ASan) reports of heap-buffer-overflow in FreeImage.
• Network: Unusual uploads of PSD files to web services or APIs that process images, particularly files with anomalous file sizes relative to their declared dimensions (PoC Gist).

The recommended remediation is to update FreeImage to a version later than 3.18.0 once a patched release is available from the upstream project. As of the disclosure date, FreeImage 3.18.0 remains the latest release and no official patch has been issued; users should monitor the FreeImage download page for updates. In the interim, organizations should validate PSD depth fields (accepting only 1, 8, or 16), verify that computed lineSize does not exceed the destination buffer size, reject PSD files with malformed or inconsistent headers, restrict or sandbox image processing of untrusted PSD files, and apply network-level controls to limit exposure of image-processing services (PoC Gist, Feedly).

Researcher carnil noted on the public PoC gist that a related, previously unfixed FreeImage bug (CVE-2024-28565, tracked at SourceForge bug #366) exists, highlighting a pattern of unresolved memory safety issues in the library, and filed a new upstream bug report (#390) to notify the FreeImage project. Researcher iamleot inquired whether the issue had been reported upstream, underscoring community concern about responsible disclosure. The vulnerability was also discussed in the oss-security mailing list in Q2 2026 (PoC Gist, oss-sec).