Every CVE Search/ Get API key

CVE-2017-14449

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2....

7.5 HighFix available

CVE-2017-14449 is a high vulnerability (CVSS 7.5) in Debian Linux, published April 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.62%, the 76th percentile. Fixed in sdl2_image 2.0.3-r0.

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.62%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Record
CVE-2017-14449
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2017-5952 7.5

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Record
EUVD-2017-5952
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-xgp4-8gx6-q392 8.8

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2....

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Record
GHSA-xgp4-8gx6-q392
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-415
Updated
2026-11-02
NVD 7.5

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Record
CVE-2017-14449
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-415
Updated
2026-11-02
OSVALPINE-CVE-2017-14449 8.8

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Record
ALPINE-CVE-2017-14449
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Record
CVE-2017-14449
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2017-14449 8.8

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Record
DEBIAN-CVE-2017-14449
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-14449 8.8

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.

Record
UBUNTU-CVE-2017-14449
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0454 No score

Updated sdl2/mingw-SDL2 packages fix security vulnerabilities

This update fixes various security vulnerabilities affecting the SDL2_image library, listed below. The fixes are provided in SDL2_image 2.0.4, which depends on SDL2 2.0.8 or later. As such, the SDL2 and SDL2_mixer libraries are also updated to their current stable releases, providing various bug fixes and features.

The security vulnerabilities fixed in this update are the following:

An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0488, CVE-2017-12122)

An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0489, CVE-2017-14440)

An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0490, CVE-2017-14441)

An exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2_image-2.0.2. A specially crafted BMP image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0491, CVE-2017-14442)

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0497, CVE-2017-14448)

A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0498, CVE-2017-14449)

A buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2.0.2. A specially crafted GIF image can lead to a buffer overflow on a global section. An attacker can display an image to trigger this vulnerability. (TALOS-2017-0499, CVE-2017-14450)

An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of SDL2_image-2.0.2. A specially crafted PCX image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2018-0519, CVE-2018-3837)

An exploitable information vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2018-0520, CVE-2018-3838)

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2018-0521, CVE-2018-3839)

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2018-0645, CVE-2018-3977)

Record
MGASA-2018-0454
Updated
2026-11-02
OSVopenSUSE-SU-2024:10608-1 No score

libSDL2_image-2_0-0-2.0.5-1.14 on GA media

These are all security issues fixed in the libSDL2_image-2_0-0-2.0.5-1.14 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10608-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sdl2_image
Alpine:v3.10
 before 2.0.3-r0
2.0.3-r0
sdl2_image
Alpine:v3.11
 before 2.0.3-r0
2.0.3-r0
sdl2_image
Alpine:v3.8
 before 2.0.3-r0
2.0.3-r0
sdl2_image
Alpine:v3.9
 before 2.0.3-r0
2.0.3-r0
libsdl2-image
Debian:12
 before 2.0.3+dfsg1-1
2.0.3+dfsg1-1
libsdl2-image
Debian:13
 before 2.0.3+dfsg1-1
2.0.3+dfsg1-1
libsdl2-image
Debian:14
 before 2.0.3+dfsg1-1
2.0.3+dfsg1-1
libsdl2-image
Debian:8
 before 2.0.0+dfsg-3+deb8u1, plus listed versions
2.0.0+dfsg-3
2.0.0+dfsg-3+deb8u1
libsdl2-image
Debian:9
 before 2.0.1+dfsg-2+deb9u1, plus listed versions
2.0.1+dfsg-2
2.0.1+dfsg-2+deb9u1
sdl2
Mageia:6
 before 2.0.9-1.mga6
2.0.9-1.mga6
Show 7 moreShow less
Affected packages
PackageAffectedFixed
sdl2_image
Mageia:6
 before 2.0.4-1.mga6
2.0.4-1.mga6
sdl2_mixer
Mageia:6
 before 2.0.4-1.mga6
2.0.4-1.mga6
mingw-SDL2
Mageia:6
 before 2.0.9-1.mga6
2.0.9-1.mga6
mingw-SDL2_image
Mageia:6
 before 2.0.4-1.mga6
2.0.4-1.mga6
mingw-SDL2_mixer
Mageia:6
 before 2.0.4-1.mga6
2.0.4-1.mga6
libsdl2-image
Ubuntu:14.04:LTS
 before 2.0.0+dfsg-3+deb8u1build0.14.04.1, plus listed versions
2.0.0+dfsg-22.0.0+dfsg-32.0.0+dfsg-3build2
2.0.0+dfsg-3+deb8u1build0.14.04.1
libsdl2-image
Ubuntu:16.04:LTS
 before 2.0.1+dfsg-2+deb9u1build0.16.04.1, plus listed versions
2.0.0+dfsg-3build22.0.1+dfsg-12.0.1+dfsg-2
2.0.1+dfsg-2+deb9u1build0.16.04.1

History

History
WhenChangedSources
2026-11-03aliases, productsEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open