CVE-2024-28565

Executive Summary

CVE-2024-28565 is a buffer overflow vulnerability in the open-source FreeImage library, version 3.19.0 (r1909). The flaw resides in the psdParser::ReadImageData() function, which is responsible for parsing PSD (Photoshop Document) image files. A local attacker can exploit this vulnerability to cause a denial of service (DoS) by providing a specially crafted PSD file that triggers a buffer overflow. The vulnerability has a CVSS score of 0.0, indicating that it has not been fully assessed or scored by NVD. No public proof-of-concept (PoC) or exploit code is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

FreeImage is a widely used library for image format support in various applications and frameworks. This vulnerability affects the library itself, and any software that statically or dynamically links to the vulnerable version of FreeImage is at risk. Users and developers should monitor for updates from the FreeImage project and consider alternative image parsing libraries if a patch is not forthcoming.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which typically indicates that the vulnerability has not been scored or that the scoring is pending. Based on the description, the attack vector is local (AV:L), and the impact is limited to availability (denial of service). Without a full vector string, the threat level is considered Low due to the local attack vector and DoS-only impact. However, if the buffer overflow can be leveraged for code execution, the severity could increase.

Deep Dive & Mechanics

The vulnerability is a classic buffer overflow in the psdParser::ReadImageData() function. This function processes the image data section of a PSD file. When parsing, it likely reads a length field from the file and uses it to copy data into a fixed-size buffer without proper bounds checking. By providing a malicious PSD file with an overly large length value, an attacker can cause the function to write beyond the allocated buffer, corrupting adjacent memory.

Root Cause: Insufficient validation of user-supplied data (the image data length) before copying into a stack or heap buffer.

Impact: The immediate impact is a denial of service (application crash). In some environments, this could potentially be escalated to arbitrary code execution if the overflow overwrites critical data structures (e.g., return addresses, function pointers).

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a typical fix would involve:

• Adding bounds checking before memory copy operations.
• Using safe functions like memcpy_s or strncpy instead of memcpy or strcpy.
• Validating the length field against the actual buffer size.

Vulnerable Code (Hypothetical):

void ReadImageData(PSDImage *img, char *data, int length) {
    char buffer[1024];
    memcpy(buffer, data, length); // No bounds check
}

Patched Code (Hypothetical):

void ReadImageData(PSDImage *img, char *data, int length) {
    char buffer[1024];
    if (length > sizeof(buffer)) {
        // Handle error
        return;
    }
    memcpy(buffer, data, length);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Vulnerable FreeImage library (v3.19.0 r1909) installed.
• Ability to deliver a malicious PSD file to the target application.

Steps:

1. Craft a PSD file with a malformed image data section. The length field in the PSD header or image resource block should be set to a value larger than the expected buffer size (e.g., 4096 bytes for a 1024-byte buffer).
2. Deliver the file to the target application (e.g., via email, web upload, or local file system).
3. When the application parses the PSD file using FreeImage, the buffer overflow will occur, causing a crash (DoS).

Note: No public exploit code is available. The above is a general methodology.

Blue Team (Defensive)

Detection:

• Monitor for crashes in applications that use FreeImage.
• Use file integrity monitoring to detect unexpected PSD files.
• Implement behavioral analysis to detect abnormal memory access patterns.

Prevention:

• Isolate applications that parse untrusted PSD files in sandboxed environments.
• Use address space layout randomization (ASLR) and data execution prevention (DEP) to mitigate exploitation.
• Apply vendor patches when available.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available.
• Network Indicators: None (local attack).
• Behavioral Indicators:
  • Application crashes when processing PSD files.
  • Memory corruption errors in logs.
  • Unexpected high memory usage during PSD parsing.

Detection Engineering

YARA Rule

rule CVE_2024_28565_FreeImage_PSD_BOF {
    meta:
        description = "Detects PSD files that may trigger buffer overflow in FreeImage v3.19.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28565"
    strings:
        $psd_header = "8BPS"
        $large_length = { FF FF 00 00 } // Example: length field > 1024
    condition:
        $psd_header at 0 and $large_length
}

Sigma Rule

title: Potential FreeImage PSD Buffer Overflow Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects crashes or memory corruption events related to FreeImage PSD parsing
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: windows
detection:
    selection:
        EventID: 1000 (Application Error)
        Image: '*freeimage*'
        Module: '*freeimage*'
    condition: selection
falsepositives:
    - Legitimate PSD files with large data
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28565 FreeImage PSD Buffer Overflow Attempt"; flow:to_server; content:"8BPS"; offset:0; depth:4; content:"|FF FF 00 00|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PSD parsing in applications using FreeImage if not required.
2. Apply input validation at the application level to reject PSD files with suspiciously large image data sections.
3. Use a memory-safe language or library for parsing untrusted files.

Long-term Fix:

• Monitor the FreeImage project for an official patch.
• Consider migrating to an alternative image library (e.g., libvips, ImageMagick) that is actively maintained.
• If patching is not possible, implement a WAF or file scanner that blocks malformed PSD files.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.