CVE-2025-70968: 
Homebrew vulnerability analysis and mitigation

CVE-2025-70968 is a Use-After-Free (UAF) vulnerability in FreeImage 3.18.0, located in the loadRLE() function within PluginTARGA.cpp. The flaw allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution or denial of service by supplying a crafted TARGA (TGA) image file with RLE compression. It affects FreeImage version 3.18.0 (the latest release), and no patch is currently available. The CVE was published on January 14, 2026, with initial analysis completed by January 23, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical), assessed by CISA-ADP (GitHub PoC).

The root cause is a pass-by-value pointer management error (CWE-416: Use After Free) in PluginTARGA.cpp. The loadRLE() function receives the FIBITMAP* dib pointer by value; when it encounters a malformed RLE data or I/O error, it calls FreeImage_Unload(dib) to free the bitmap memory and sets its local copy to NULL — but the caller's pointer in the Load() function remains unchanged and now dangling. Subsequently, if the TGA image header specifies a vertical or horizontal flip (via the Image Descriptor byte), Load() calls FreeImage_FlipVertical(dib) or FreeImage_FlipHorizontal(dib) on the freed memory, triggering an access violation. In a controlled heap environment (e.g., multi-threaded or browser context), an attacker could reallocate the freed FIBITMAP struct with a fake object, enabling arbitrary memory writes via the flip operations and potentially leading to RCE (GitHub PoC).

Successful exploitation can result in a crash (Denial of Service) at minimum, and potentially arbitrary code execution at the privilege level of the process loading the image. Because the vulnerability is exploitable remotely without authentication or user interaction, any network-accessible service that processes TARGA image files using FreeImage 3.18.0 is at risk of complete system compromise, with high impact to confidentiality, integrity, and availability. In scenarios where heap layout can be manipulated, the UAF primitive enables arbitrary memory writes, which can be leveraged to overwrite function pointers or return addresses for full RCE (GitHub PoC).

A public proof-of-concept (PoC) exploit, including crash samples generated via fuzzing and a poc.cpp file, is available on GitHub (GitHub PoC). The PoC was authored by 'MiracleWolf' and dated January 7, 2026, with the CVE published January 14, 2026. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.043% (low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify applications or services that use FreeImage 3.18.0 for image processing, particularly those that accept TARGA (.tga) image uploads or process remote image URLs.
2. Craft malicious TGA file: Create a TARGA image file with RLE compression enabled and malformed RLE data (e.g., truncated or invalid RLE sequences) that will cause loadRLE() to fail and call FreeImage_Unload(dib). Set the Image Descriptor byte in the TGA header to enable vertical or horizontal flip.
3. Trigger the UAF: Submit the crafted TGA file to the target application. The loadRLE() function frees the FIBITMAP memory, but the Load() function retains the dangling pointer and proceeds to call FreeImage_FlipVertical(dib) or FreeImage_FlipHorizontal(dib), triggering an access violation.
4. Heap manipulation (for RCE): In environments where heap layout can be controlled (e.g., multi-threaded servers or browser-based image processing), time the heap reallocation to place a fake FIBITMAP object at the freed address before the flip operation executes, supplying attacker-controlled internal data pointers.
5. Achieve arbitrary write / RCE: The flip operation performs pixel-swapping writes on the attacker-controlled memory addresses, enabling overwrite of function pointers or return addresses to redirect execution flow (GitHub PoC).

• Process: Application crashes (access violation / segfault) in processes loading TARGA images via FreeImage, particularly in FreeImage_HasPixels, FreeImage_FlipVertical, or FreeImage_FlipHorizontal call stacks.
• Logs: Windows Event Logs or crash dumps showing exception code 0xc0000005 (Access Violation) originating from FreeImaged.dll or FreeImage.dll at offsets related to FreeImage_HasPixels or FreeImage_FlipVertical.
• File System: Presence of unexpected or malformed .tga files in upload directories or temporary processing folders; crash dump files (.dmp) generated by the affected application.
• Network: Unusual inbound requests delivering .tga files or image data to services that process images, especially with abnormal file sizes or repeated failed processing attempts (GitHub PoC).

No official patch is currently available from the FreeImage project for version 3.18.0. Organizations should immediately inventory all systems and applications using FreeImage 3.18.0 and restrict network access to services that process TARGA image files. If possible, disable TARGA image processing functionality or filter/block .tga file uploads at the application or WAF layer. Consider isolating affected systems and monitoring for updates from the FreeImage project. As a compensating control, run image-processing services in sandboxed or low-privilege environments to limit the impact of exploitation (GitHub PoC).

The vulnerability received coverage from several security aggregation sites and blogs shortly after disclosure, including The Hacker Wire and Infinit Security. Social media posts on Bluesky noted the CVE's publication. No official statement from the FreeImage project has been issued, and no major vendor advisories have been published. Community reaction has been limited, consistent with the low EPSS score and absence of active exploitation evidence.