Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka…
Priority MEDIUM 49CWE-415Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.
Summary
Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
Why it matters now
EPSS 0.04486 91st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat OpenShift Enterprise 2
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6912
- 2026-10-03 Alias added: GHSA-wmff-45hx-q83q
References
More Libgd vulnerabilities
- TI-2019-04913 gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as… CVSS 3.0HIGH 8.8
- TI-2016-02573 Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote… CVSS 3.1CRITICAL 9.8
- TI-2016-08242 Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD… CVSS 3.0CRITICAL 9.8
- TI-2016-07128 Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics… CVSS 3.0CRITICAL 9.8
- TI-2016-06432 Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library… CVSS 3.0CRITICAL 9.8
- TI-2019-04914 The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr()… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2016-6912 · CVE Program
- CVE-2016-6912 · NVD
- FIRST EPSS
- GHSA-wmff-45hx-q83q · GitHub Advisory Database · CC BY 4.0
- CVE-2016-6912 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences