PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6912 Libgd CVE debrief

CVE-2016-6912 is a critical double-free vulnerability in libgd’s gdImageWebPtr function. According to the NVD record, it affects libgd versions up to 2.2.3 and was fixed before 2.2.4. The issue is remotely reachable and rated CVSS 3.0 9.8, reflecting low attack complexity and no required privileges or user interaction.

Vendor
Libgd
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-26
Original CVE updated
2026-05-13
Advisory published
2017-01-26
Advisory updated
2026-05-13

Who should care

Teams that build, package, or deploy software relying on libgd should care immediately, especially if image processing is exposed to untrusted input or network-facing services. Debian maintainers and downstream distributors should verify that their packaged libgd version includes the 2.2.4 fix.

Technical summary

The NVD record identifies a double free in gdImageWebPtr, classified as CWE-415. The vulnerable version range ends at 2.2.3, with 2.2.4 listed as the fixed release in the linked libgd changelog and commit reference. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely exploitable flaw with potentially high confidentiality, integrity, and availability impact.

Defensive priority

Immediate. This is a network-exploitable memory-safety flaw with critical CVSS severity and no authentication or user interaction required. Patch or upgrade libgd to 2.2.4 or later as soon as possible, then validate dependent packages and rebuild any bundled copies.

Recommended defensive actions

  • Upgrade libgd to version 2.2.4 or later, or apply the vendor/backport fix used by your distribution.
  • Inventory applications and packages that link against libgd, including transitive dependencies and bundled copies.
  • Prioritize internet-facing services and any workflow that processes untrusted image content.
  • Confirm your deployed version is outside the affected range ending at 2.2.3.
  • Use your distribution security advisory or vendor changelog to verify the fix has been incorporated.
  • If immediate upgrade is not possible, restrict exposure of image-processing entry points until remediation is complete.

Evidence notes

This debrief is grounded in the supplied NVD CVE record and its linked references. The record states a double free in gdImageWebPtr, affected versions through 2.2.3, the CWE-415 mapping, and the CVSS 3.0 vector. The linked Debian advisory, libgd changelog, and libgd commit reference support the remediation timeline and fixed release. No exploit details or unsupported claims were used.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6912 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6912

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6912 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6912

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.