CVE-2025-65803

Heap Buffer Overflow DoS Vulnerability in FreeImage (psdParser::ReadImageData)

CVE-ID: CVE-2025-65803
Affected Component: psdParser::ReadImageData
Affected Product: FreeImage ≤ 3.18.0
Impact: Denial of Service (DoS), potential memory corruption

---

Overview

A crafted PSD file can trigger a heap-buffer-overflow in FreeImage during image parsing.
The issue exists in psdParser::ReadImageData, where the parser computes the number of bytes per row (lineSize) directly from PSD header values without verifying whether the depth field is valid.

When an attacker provides an abnormally large depth, the computed lineSize becomes extremely large. This value is subsequently used in a memcpy() operation, overflowing the destination bitmap row buffer and causing a crash.

---

Technical Description

PSD header fields such as depth, width, and channels are used to calculate:
bytes = depth / 8
lineSize = width * bytes

FreeImage allocates a normal-sized bitmap row buffer based on expected bit-depth (e.g., ~80 bytes).
However, with a malicious PSD header, lineSize can reach tens of kilobytes.

The parser then performs:

memcpy(dst_line_start, src, lineSize)

---

Trigger Conditions

• A PSD file contains an abnormally large or malformed depth field
• nCompression = NONE, causing the parser to copy raw pixel data using the inflated lineSize
• The application attempts to load the PSD using FreeImage_Load()

Any application using FreeImage to open PSD files is impacted.

---

Mitigation Recommendations

• Validate PSD depth values (allow only expected values such as 1, 8, 16)
• Verify that lineSize does not exceed the size of the destination row buffer
• Reject PSD files with inconsistent or malformed header fields
• Apply sandboxing when processing untrusted images

---

Hello @1mxml!
Have you reported that to upstream?

FWIW, there was as well in past (and yet unfixed): https://sourceforge.net/p/freeimage/bugs/366/ (CVE-2024-28565).

I have asked in https://sourceforge.net/p/freeimage/bugs/390/

Thanks @carnil!