CVE-2024-31570

CRITICAL

libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS0.6%
Percentile48th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-121: Stack-Based Buffer Overflow

Buffer overflow corrupting the program stack, typically overwriting the return address for code execution.

CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

◆ AI Analysis — automated analysis, not human-reviewed

A stack-based buffer overflow vulnerability exists in the PluginXPM.cpp Load function of libfreeimage in FreeImage versions 3.4.0 through 3.18.0, which can be exploited via a specially crafted XPM file.

BSID: BS-2024-GLOBAL-191464-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-31570?
A stack-based buffer overflow vulnerability exists in the PluginXPM.cpp Load function of libfreeimage in FreeImage versions 3.4.0 through 3.18.0, which can be exploited via a specially crafted XPM file.
What is the CVSS score for CVE-2024-31570?
CVE-2024-31570 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.6%.
Is CVE-2024-31570 actively exploited?
No confirmed active exploitation of CVE-2024-31570 as of 2026-05-30.
How do I remediate CVE-2024-31570?
Priority: IMMEDIATE.
What systems are affected by CVE-2024-31570?
CVE-2024-31570 affects Freeimage Project Freeimage.
Vulnerability Details
CVE IDCVE-2024-31570
BSIDBS-2024-GLOBAL-191464-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2024-09-19
Last Modified2024-09-25
ICS Relevance15%
Weakness (CWE)
Stack-Based Buffer OverflowOut-of-Bounds Write
SourceNVD
Official Description

libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is triggered when the Load function in PluginXPM.cpp does not properly validate the size of the input XPM file, leading to a stack-based buffer overflow. An attacker can exploit this by providing a malicious XPM file to the affected application, potentially leading to arbitrary code execution.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Freeimage Project Freeimage ≥ 3.4.0, ≤ 3.18.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 756 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash824025ff4c7715beb6515cdf74e780fa714dbcb3e6b714024d1ca1484ad69eb31533731ecbac3dc9d1723f7aa5b7ebf40db23b40e61dc1ead954879836ba6472
Related CVEs affecting Freeimage Project
CVE-2025-70968 9.8 FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE(). CVE-2021-40263 8.8 A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in ... CVE-2020-24292 8.8 Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage ... CVE-2020-24293 8.8 Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeI... CVE-2020-24295 8.8 Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in FreeImage ...
View all Freeimage Project CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →