CVE-2021-40266

What it actually does

Null pointer dereference in the ReadPalette function of PluginTIFF.cpp when processing specially crafted TIFF images, resulting in application crash and denial of service.

Why it matters to the business

Applications and services relying on FreeImage for image handling may experience unexpected crashes when users open or process malicious TIFF files, leading to downtime and potential loss of availability for image-dependent workflows.

How an attack unfolds

An attacker crafts a malicious TIFF image that triggers a null pointer dereference in ReadPalette, then delivers it to a target application using a vulnerable FreeImage version; when the victim opens or processes the image, the application crashes.

How to fix it

Upgrade FreeImage to version 1.18.0 or later. Where immediate upgrade is not possible, implement input validation or sandboxing around image processing components.

How to confirm the fix worked

Confirm FreeImage version is 1.18.0 or newer; test image processing functionality with known-good and boundary-case TIFF files to verify absence of crashes.

Typical attack path

1. Identify applications using FreeImage for TIFF processing
2. Craft a TIFF image that causes null pointer dereference in ReadPalette
3. Deliver the malicious image via email, web upload, or file share
4. Victim opens or processes the image triggering the crash

How to detect it

Review application logs and crash dumps for segmentation faults or null pointer exceptions occurring during TIFF image loading or palette reading operations.

What your security team should do

• Prioritize upgrade to FreeImage 1.18.0 across all affected systems
• Monitor for application crashes during image processing and investigate unusual patterns
• Restrict untrusted image file handling until patched