CVE-2025-65803
📋 TL;DR
An integer overflow vulnerability in FreeImage's PSD parser allows attackers to cause Denial of Service by supplying a specially crafted PSD file. This affects applications using FreeImage v3.18.0 and earlier to process PSD files. Developers and systems that handle user-uploaded PSD files are primarily at risk.
💻 Affected Systems
- FreeImage
📦 What is this software?
Freeimage by Freeimage Project
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to sustained Denial of Service, potentially affecting availability of services that process PSD files.
Likely Case
Application crash when processing malicious PSD files, causing temporary service disruption until the process restarts.
If Mitigated
Controlled application termination with proper error handling, minimal service impact with automatic restart mechanisms.
🎯 Exploit Status
Exploitation requires only a crafted PSD file, making it easy to weaponize for DoS attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.19.0 or later
Vendor Advisory: https://freeimage.sourceforge.io/download.html
Restart Required: Yes
Instructions:
1. Download FreeImage v3.19.0 or later from official source. 2. Replace existing FreeImage library files. 3. Recompile applications linking to FreeImage. 4. Restart affected services.
🔧 Temporary Workarounds
Disable PSD file processing
allConfigure applications to reject or skip PSD file processing
Input validation for PSD files
allImplement file validation before passing to FreeImage parser
🧯 If You Can't Patch
- Implement strict file upload restrictions for PSD files
- Deploy application-level monitoring for crashes related to image processing
🔍 How to Verify
Check if Vulnerable:
Check FreeImage version in use by applications. If version is 3.18.0 or earlier and PSD processing is enabled, system is vulnerable.Check Version:
Check application documentation or build configuration for FreeImage version referenceVerify Fix Applied:
Verify FreeImage version is 3.19.0 or later and test with known malicious PSD files to ensure no crashes occur.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Error logs mentioning FreeImage or psdParser
- Unusual termination of image processing services
Network Indicators:
- Multiple failed upload attempts of PSD files
- Unusual traffic patterns to image processing endpoints
SIEM Query:
source="application.log" AND ("segmentation fault" OR "FreeImage" OR "psdParser")