VulnerabilityDeferred

CVE-2022-4988

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries.

HIGH 7.3EPSS 0.29%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Alien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities such as CVE-2015-0852 and CVE-2025-65803. The library embeds other images libraries that also have known vulnerabilities.

CVSS 3.1: 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

References

https://freeimage.sourceforge.io/
https://github.com/kmx/alien-freeimage/issues/4
https://github.com/kmx/alien-freeimage/issues/5
https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source
https://nvd.nist.gov/vuln/detail/CVE-2015-0852
https://nvd.nist.gov/vuln/detail/CVE-2025-65803

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.