CVE-2024-31570

What it actually does

Stack-based buffer overflow write in the Load() function during XPM image parsing allows an attacker to overwrite the stack and achieve arbitrary code execution.

Why it matters to the business

Processing a malicious image file with an affected application can result in full system compromise, data theft, or ransomware deployment; the library's wide use in imaging and graphics tools increases exposure across many products.

How an attack unfolds

An attacker creates a specially crafted XPM file that triggers excessive data writes during parsing; the file is supplied to any application that invokes FreeImage's Load() routine on untrusted input, causing the overflow and subsequent shellcode execution.

How to fix it

Update the FreeImage library to the latest available version that resolves the XPM parsing flaw; if no update exists, disable XPM support or sandbox applications that process untrusted images.

How to confirm the fix worked

Confirm the FreeImage version in use is newer than 3.19.0 r1909; test that malformed XPM files no longer cause crashes or unexpected code paths in the Load() function.

Typical attack path

1. Craft malicious XPM image that exceeds expected buffer sizes
2. Deliver the image via file upload, email attachment, or web content
3. Victim application calls FreeImage Load() on the XPM data
4. Overflow overwrites return address or stack variables
5. Attacker-supplied code executes with the privileges of the host process

How to detect it

Review application and system logs for segmentation faults or crashes immediately after XPM image loading attempts; correlate with file-access events involving .xpm extensions from untrusted sources.

What your security team should do

• Inventory all applications and dependencies that ship or link FreeImage
• Prioritize patching or replacing the library in internet-facing or high-privilege contexts
• Implement input validation or file-type restrictions to block XPM where feasible
• Add runtime monitoring for image-processing crashes as a temporary control