CVE-2018-10114

An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in...

8.8 HighFix available

CVE-2018-10114 is a high vulnerability (CVSS 8.8) in Gegl, published April 14, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.89%, the 79th percentile. Fixed in gegl 0.3.34-1.

An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in buffer/gegl-buffer-access.c allows remote attackers to cause a denial of service (write access violation) or possibly have unspecified other impact via a malformed PPM file, related to improper restrictions on memory allocation in the ppm_load_read_header function in operations/external/ppm-load.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.89%Up 0.9 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2018-10114
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-10114
Updated: 2026-11-02

EUVDEUVD-2018-2193 No score

Record: EUVD-2018-2193
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w9gq-wjp3-cvf5 8.8

An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in...

Record: GHSA-w9gq-wjp3-cvf5
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 8.8

Record: CVE-2018-10114
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-10114 8.8

Record: DEBIAN-CVE-2018-10114
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-10114 8.8

Record: UBUNTU-CVE-2018-10114
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10782-1 No score

gegl-0.4.30-2.8 on GA media

These are all security issues fixed in the gegl-0.4.30-2.8 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10782-1
Updated: 2026-11-02

Affected products

gegl

Affected packages

Affected packages
Package	Affected	Fixed
`gegl` Debian:12	before 0.3.34-1	0.3.34-1
`gegl` Debian:13	before 0.3.34-1	0.3.34-1
`gegl` Debian:14	before 0.3.34-1	0.3.34-1
`gegl` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 0.3.0-4ubuntu20.3.2-1ubuntu10.3.2-1ubuntu20.3.4-1ubuntu10.3.4-1ubuntu20.3.4-1ubuntu2+esm1	None known
`gegl` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 0.3.20-10.3.20-30.3.24-10.3.28-30.3.30-10.3.30-1ubuntu10.3.30-1ubuntu1+esm1	None known
`gegl` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 0.4.14-10.4.18-1ubuntu10.4.18-20.4.18-2build10.4.22-10.4.22-30.4.22-3ubuntu0.1~esm1	None known
`gegl` Ubuntu:22.04:LTS	All versions, plus listed versions 1:0.4.32-11:0.4.32-21:0.4.34-11:0.4.34-1build1	None known
`gegl` Ubuntu:24.04:LTS	All versions, plus listed versions 1:0.4.44-3ubuntu11:0.4.46-41:0.4.48-11:0.4.48-2.4build11:0.4.48-2.4build2	None known
`gegl` Ubuntu:25.10	All versions, plus listed versions 1:0.4.58-11:0.4.58-21:0.4.62-11:0.4.62-21:0.4.62-31:0.4.62-3.1	None known
`gegl` Ubuntu:26.10	All versions, plus listed versions 1:0.4.70-11:0.4.70-3build11:0.4.70-4	None known
`gegl` Ubuntu:26.04:LTS	All versions, plus listed versions 1:0.4.62-3.11:0.4.64-11:0.4.64-21:0.4.66-21:0.4.66-31:0.4.68-11:0.4.70-1	None known
`gegl` openSUSE:Tumbleweed	before 0.4.30-2.8	0.4.30-2.8

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV