CVE-2023-47993

What it actually does

Out-of-bounds read in Exif.cpp::ReadInt32 during EXIF metadata parsing in FreeImage 3.18.0 allows reading past allocated buffer boundaries, resulting in denial of service via application crash.

Why it matters to the business

Services and applications that process images with FreeImage may crash when handling attacker-supplied files, interrupting workflows that depend on reliable image handling; more than 1000 days after disclosure and with public exploits available, unpatched deployments remain exposed.

How an attack unfolds

An attacker supplies a crafted image containing malformed EXIF data to an application using FreeImage; during parsing the ReadInt32 function performs an out-of-bounds read that crashes the process. Public exploit code exists for this issue.

How to fix it

Upgrade FreeImage to a version containing bounds checks in ReadInt32 once released by the project; until then, isolate image-processing components or reject untrusted image inputs.

How to confirm the fix worked

Re-test parsing of known trigger images after any code change; confirm absence of crashes and verify that buffer-length checks now exist in Exif.cpp::ReadInt32.

Typical attack path

1. Attacker crafts a malicious image file with malformed EXIF metadata
2. Victim application receives and processes the image using FreeImage
3. Exif.cpp::ReadInt32 executes an out-of-bounds memory read
4. Application terminates or becomes unresponsive

How to detect it

Monitor application and system logs for crashes or access-violation events that occur while processing image files with FreeImage; correlate such events with receipt of external image content.

What your security team should do

• Inventory all products and services that embed FreeImage 3.18.0
• Apply updates immediately when fixed versions become available
• Implement sandboxing or process isolation around image parsing
• Block or sanitize untrusted image uploads until remediation is complete