CVE-2024-28568

MEDIUM

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the read_iptc_profile() function when reading images in TIFF format.

Affects 1 product across 1 vendor.

CVSS 3.16.2
EPSS0.3%
Percentile20th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-121: Stack-Based Buffer Overflow

Buffer overflow corrupting the program stack, typically overwriting the return address for code execution.

◆ AI Analysis — automated analysis, not human-reviewed

A buffer overflow vulnerability in FreeImage v.3.19.0 [r1909] can be exploited by a local attacker to cause a denial of service (DoS) through the read_iptc_profile() function when processing TIFF images.

BSID: BS-2024-GLOBAL-206483-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-28568?
A buffer overflow vulnerability in FreeImage v.3.19.0 [r1909] can be exploited by a local attacker to cause a denial of service (DoS) through the read_iptc_profile() function when processing TIFF images.
What is the CVSS score for CVE-2024-28568?
CVE-2024-28568 has CVSS 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS: 0.3%.
Is CVE-2024-28568 actively exploited?
No confirmed active exploitation of CVE-2024-28568 as of 2026-05-30.
How do I remediate CVE-2024-28568?
Priority: MEDIUM.
What systems are affected by CVE-2024-28568?
CVE-2024-28568 affects Freeimage Project Freeimage.
Vulnerability Details
CVE IDCVE-2024-28568
BSIDBS-2024-GLOBAL-206483-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published2024-03-20
Last Modified2025-03-28
ICS Relevance15%
Weakness (CWE)
Stack-Based Buffer Overflow
SourceNVD
Official Description

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the read_iptc_profile() function when reading images in TIFF format.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper bounds checking in the read_iptc_profile() function, which can be triggered by a specially crafted TIFF image file. An attacker can exploit this to overwrite adjacent memory, leading to a crash of the application.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Freeimage Project Freeimage 3.19.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 940 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash529a1abdfdc75e841de83daf76ab155503cda5efc1ac502078c318e169bbe18b5469fc744c9a38aa078664374c32381e3647313997077e6babb54250919f7ff2
Related CVEs affecting Freeimage Project
CVE-2025-70968 9.8 FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE(). CVE-2024-31570 9.8 libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overf... CVE-2021-40263 8.8 A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in ... CVE-2020-24293 8.8 Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeI... CVE-2020-24292 8.8 Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage ...
View all Freeimage Project CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →