CVE-2016-9969

In libwebp 0.5.1, there is a double free bug in libwebpmux.

7.5 HighFix available

CVE-2016-9969 is a high vulnerability (CVSS 7.5) in Webmproject Libwebp, published May 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in libwebp 0.5.2-1.

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.41%Up 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Record: CVE-2016-9969
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness: CWE-415
Updated: 2026-11-02

CVE List No score

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Record: CVE-2016-9969
Updated: 2026-11-02

EUVDEUVD-2019-0168 No score

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Record: EUVD-2019-0168
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fhhw-9rjc-7m26 7.5

In libwebp 0.5.1, there is a double free bug in libwebpmux.

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Record: GHSA-fhhw-9rjc-7m26
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-415
Updated: 2026-11-02

OSV 7.5

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Record: CVE-2016-9969
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-9969 7.5

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Record: DEBIAN-CVE-2016-9969
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVPYSEC-2019-256 7.5

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Record: PYSEC-2019-256
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-9969 7.5

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Record: UBUNTU-CVE-2016-9969
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVSUSE-SU-2025:01639-1 No score

Security update for libwebp

This update for libwebp fixes the following issues:

CVE-2016-9969: freeing of uninitialized memory pointer in SetFrame() of AnimEncoder can lead to double free (bsc#1136199).

Record: SUSE-SU-2025:01639-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01639-2 No score

Security update for libwebp

This update for libwebp fixes the following issues:

CVE-2016-9969: freeing of uninitialized memory pointer in SetFrame() of AnimEncoder can lead to double free (bsc#1136199).

Record: SUSE-SU-2025:01639-2
Updated: 2026-11-02

Affected products

webmproject libwebp

Affected packages

Affected packages
Package	Affected	Fixed
`libwebp` Debian:12	before 0.5.2-1	0.5.2-1
`libwebp` Debian:13	before 0.5.2-1	0.5.2-1
`libwebp` Debian:14	before 0.5.2-1	0.5.2-1
`libwebp` SUSE:Linux Enterprise Module for Package Hub 15 SP6	before 0.5.0-150000.3.17.1	0.5.0-150000.3.17.1
`libwebp` SUSE:Linux Enterprise Workstation Extension 15 SP6	before 0.5.0-150000.3.17.1	0.5.0-150000.3.17.1
`libwebp` SUSE:Linux Enterprise Module for Package Hub 15 SP7	before 0.5.0-150000.3.17.1	0.5.0-150000.3.17.1
`libwebp` SUSE:Linux Enterprise Workstation Extension 15 SP7	before 0.5.0-150000.3.17.1	0.5.0-150000.3.17.1
`mozjs52` Ubuntu:18.04:LTS	All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1	None known
`mozjs38` Ubuntu:18.04:LTS	All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4	None known
`mozjs52` Ubuntu:20.04:LTS	All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3	None known

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	affected, aliases, references	EUVD
2026-11-02	created	OSV
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less