8.1

CVE-2026-9672: libgd2

CVSS: 8.1v3.1HighPublished
AliasesMGASA-2026-0412SUSE-SU-2026:23213-1SUSE-SU-2026:23224-1
Published 16-09-2026Last modified 16-09-2026
Open JSON

Vulnerability summary

CVE-2026-9672 is a high (CVSS 8.1) vulnerability in libgd2.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (OSV · Red hat), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 8
MGASA-2026-0329MGASA-2026-0330OPENSUSE-SU-2026:11418-1OPENSUSE-SU-2026:21532-1SUSE-SU-2026:23121-1SUSE-SU-2026:23144-1

Timeline

  1. 16-09-2026
    PublishedVulnerability first disclosed.
  2. 16-09-2026
    Last modifiedVulnerability information updated.

Description

Updated libgd packages fix a security vulnerability A vulnerability was discovered in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a malformed GIF file is processed.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse17 products
  • gd&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.2.5-150200.11.8.1
  • gd&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.2.5-150200.11.8.1
  • gd&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 2.2.5-150200.11.8.1
  • gd&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 2.2.5-150200.11.8.1
  • gd&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 2.2.5-150200.11.8.1
Redhat6 products
  • gd< 0:2.3.3-22.1.hum1 | < 0:2.2.5-8.el8_10 | < 0:2.3.3-20.el10_0.1 | < 0:2.3.2-3.el9_8.1 | < 0:2.3.3-20.el10_2.1 | < 0:2.3.2-3.el9_6.1 | < 0:2.3.2-3.el9_4.1 | < 0:2.3.2-3.el9_2.1
  • gd-debuginfo< 0:2.2.5-8.el8_10 | < 0:2.3.3-20.el10_0.1 | < 0:2.3.2-3.el9_8.1 | < 0:2.3.3-20.el10_2.1 | < 0:2.3.2-3.el9_6.1 | < 0:2.3.2-3.el9_4.1 | < 0:2.3.2-3.el9_2.1
  • gd-debugsource< 0:2.2.5-8.el8_10 | < 0:2.3.3-20.el10_0.1 | < 0:2.3.2-3.el9_8.1 | < 0:2.3.3-20.el10_2.1 | < 0:2.3.2-3.el9_6.1 | < 0:2.3.2-3.el9_4.1 | < 0:2.3.2-3.el9_2.1
  • gd-devel< 0:2.3.3-22.1.hum1 | < 0:2.2.5-8.el8_10 | < 0:2.3.3-20.el10_0.1 | < 0:2.3.2-3.el9_8.1 | < 0:2.3.3-20.el10_2.1 | < 0:2.3.2-3.el9_6.1 | < 0:2.3.2-3.el9_4.1 | < 0:2.3.2-3.el9_2.1
  • gd-progs< 0:2.3.3-22.1.hum1
Debian3 products
  • libgd2< 2.3.3-9+deb12u1 | < 2.3.3-14~deb13u1 | < 2.3.3-14
  • php8.2< 8.2.33-1~deb12u1
  • php8.4< 8.4.24-1~deb13u1 | < 8.4.24-1
Ubuntu3 products
  • libgd2All versions (No fix recorded)
  • php5All versions (No fix recorded)
  • php7.2All versions (No fix recorded)
Mageia2 products
  • libgd< 2.3.3-11.1.mga10
  • libgd< 2.3.3-6.1.mga9
Opensuse2 products
  • gd&distro=openSUSE Leap 16.0< 2.3.3-160000.3.1
  • gd&distro=openSUSE Tumbleweed< 2.3.3-5.1

6 vendors · 33 products

References

35 links
Show all 35 references