CVE-2023-47997

What it actually does

The flaw triggers an infinite loop inside BitmapAccess.cpp::FreeImage_AllocateBitmap, consuming CPU and blocking further execution without crashing the process.

Why it matters to the business

Applications that process images with FreeImage can become unresponsive, causing service outages, delayed workflows, and increased operational load until the affected process is restarted.

How an attack unfolds

An attacker supplies a specially crafted bitmap or image file that reaches FreeImage_AllocateBitmap; the function enters an infinite loop, exhausting CPU resources and denying service to other users or requests.

How to fix it

Upgrade to a patched FreeImage release when published by the project maintainers. In the interim, enforce strict input validation on image dimensions and file sizes, apply OS-level resource limits to image-processing processes, and isolate image-handling workloads.

How to confirm the fix worked

Compile a test harness that exercises FreeImage_AllocateBitmap with known triggering inputs and confirm the loop no longer occurs; monitor process CPU and memory metrics under load after applying mitigations.

Typical attack path

1. Locate a service or application that links against FreeImage for image handling
2. Prepare a malicious bitmap payload designed to trigger the allocation loop
3. Deliver the payload through file upload, network request, or local file access
4. Observe sustained high CPU usage and unresponsiveness in the target process

How to detect it

Search process and system logs for repeated calls to allocation routines without completion, monitor for sustained high CPU on image-processing workers, and inspect any available stack traces or core dumps showing the allocation function.

What your security team should do

• Prioritize upgrade to a fixed FreeImage version as soon as it becomes available
• Add runtime resource limits and timeouts around image-processing calls
• Enable logging of image-processing failures and high-CPU events for alerting
• Review all direct and transitive dependencies that ship FreeImage 3.18.0