CVE-2021-38115
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote...
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
CVE-2021-38115- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
CVE-2021-38115- Updated
- 2026-11-02
EUVDEUVD-2021-24588 No score
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
EUVD-2021-24588- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-26x8-wc99-6x99
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote...
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
GHSA-26x8-wc99-6x99- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-38115
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
ALPINE-CVE-2021-38115- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-6431
CVE-2021-38115 affecting package gd for versions less than 2.3.3-1
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
AZL-6431- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVBELL-CVE-2021-38115
CVE-2021-38115 does not affect BellSoft software
- Record
BELL-CVE-2021-38115- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
CVE-2021-38115- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-38115
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
DEBIAN-CVE-2021-38115- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-360
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
JLSEC-2026-360- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVOESA-2021-1315
gd security update
Security Fix(es):
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.(CVE-2021-38115)
- Record
OESA-2021-1315- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-38115
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
- Record
UBUNTU-CVE-2021-38115- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2021-1635459219 No score
Fix CVE(s): CVE-2021-40812, CVE-2021-40145, CVE-2021-38115, CVE-2017-6363
- SECURITY UPDATE: unhandled memory allocation error in gdImageGd2Ptr
- debian/patches/CVE-2021-40145.patch: check for non-zero return code from _gdImageGd2
- CVE-2021-40145
- SECURITY UPDATE: unhandled value returned from gdPutBuf
- debian/patches/CVE-2021-40812.patch: handle possible gdPutBuf error in _gdImageBmpCtx and _gdImageWebpCtx CVE-2021-40812
- SECURITY UPDATE: unhandled value returned from gdGetBuf
- debian/patches/CVE-2021-38115.patch: handle possible gdGetBuf error in read_header_tga CVE-2021-38115
- SECURITY UPDATE: handle possible heap buffer overread
- debian/patches/CVE-2017-6363.patch: make sure transparent index is within bounds of the palette CVE-2017-6363
- Record
CLSA-2021-1635459219- Updated
- 2026-11-02
OSVCLSA-2026-1777301041 No score
gd: Fix of CVE-2021-38115
- Fix CVE-2021-38115: out-of-bounds read in read_header_tga()
- Record
CLSA-2026-1777301041- Updated
- 2026-11-02
OSVMGASA-2021-0433 No score
Updated libgd packages fix security vulnerability
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. (CVE-2021-38115)
gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. (CVE-2021-40145)
- Record
MGASA-2021-0433- Updated
- 2026-11-02
OSVUSN-5068-1 No score
libgd2 vulnerabilities
It was discovered that GD Graphics Library incorrectly handled certain GD and GD2 files. An attacker could possibly use this issue to cause a crash or expose sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 ESM, and Ubuntu 14.04 ESM. (CVE-2017-6363)
It was discovered that GD Graphics Library incorrectly handled certain TGA files. An attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2021-381)
It was discovered that GD Graphics Library incorrectly handled certain files. An attacker could possibly use this issue to cause a crash. (CVE-2021-40145)
- Record
USN-5068-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gdAlpine:v3.11 |
before 2.2.5-r4 | 2.2.5-r4 |
gdAlpine:v3.12 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.13 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.14 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.15 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.16 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.17 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.18 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.19 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.20 |
before 2.3.0-r1 | 2.3.0-r1 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gdAlpine:v3.21 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.22 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.23 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAlpine:v3.24 |
before 2.3.0-r1 | 2.3.0-r1 |
gdAzure Linux:2 |
before 2.3.3-1 | 2.3.3-1 |
libgd-devTuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs |
before 2.1.1-4ubuntu0.16.04.13 | 2.1.1-4ubuntu0.16.04.13 |
libgd-toolsTuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs |
before 2.1.1-4ubuntu0.16.04.13 | 2.1.1-4ubuntu0.16.04.13 |
libgd3TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs |
before 2.1.1-4ubuntu0.16.04.13 | 2.1.1-4ubuntu0.16.04.13 |
gdTuxCare:AlmaLinux:9.2 |
before 2.3.2-3.el9.tuxcare.els2 | 2.3.2-3.el9.tuxcare.els2 |
gd-develTuxCare:AlmaLinux:9.2 |
before 2.3.2-3.el9.tuxcare.els2 | 2.3.2-3.el9.tuxcare.els2 |
gd-progsTuxCare:AlmaLinux:9.2 |
before 2.3.2-3.el9.tuxcare.els2 | 2.3.2-3.el9.tuxcare.els2 |
libgd2Debian:12 |
before 2.3.3-1 | 2.3.3-1 |
libgd2Debian:13 |
before 2.3.3-1 | 2.3.3-1 |
libgd2Debian:14 |
before 2.3.3-1 | 2.3.3-1 |
libgd2Debian:10 From an advisory covering 3 CVEs |
before 2.2.5-5.2+deb10u1, plus listed versions 2.2.5-5.2 |
2.2.5-5.2+deb10u1 |
libgd2Debian:11 From an advisory covering 3 CVEs |
before 2.3.0-2+deb11u1, plus listed versions 2.3.0-2 |
2.3.0-2+deb11u1 |
LibGD_jllJulia |
before 2.3.3+0 | 2.3.3+0 |
libgdMageia:8 From an advisory covering 2 CVEs |
before 2.3.1-1.1.mga8 | 2.3.1-1.1.mga8 |
gdopenEuler:20.03-LTS-SP1 |
before 2.3.0-2.oe1 | 2.3.0-2.oe1 |
gdopenEuler:20.03-LTS-SP2 |
before 2.3.0-2.oe1 | 2.3.0-2.oe1 |
libgd2Ubuntu:Pro:14.04:LTS |
before 2.1.0-3ubuntu0.11+esm2, plus listed versions 2.1.0-22.1.0-32.1.0-3ubuntu0.12.1.0-3ubuntu0.22.1.0-3ubuntu0.3 Show 7 moreShow less2.1.0-3ubuntu0.52.1.0-3ubuntu0.62.1.0-3ubuntu0.72.1.0-3ubuntu0.82.1.0-3ubuntu0.102.1.0-3ubuntu0.112.1.0-3ubuntu0.11+esm1 |
2.1.0-3ubuntu0.11+esm2 |
libgd2Ubuntu:Pro:16.04:LTS |
before 2.1.1-4ubuntu0.16.04.12+esm1, plus listed versions 2.1.1-4build12.1.1-4build22.1.1-4ubuntu0.16.04.12.1.1-4ubuntu0.16.04.22.1.1-4ubuntu0.16.04.3 Show 7 moreShow less2.1.1-4ubuntu0.16.04.52.1.1-4ubuntu0.16.04.62.1.1-4ubuntu0.16.04.72.1.1-4ubuntu0.16.04.82.1.1-4ubuntu0.16.04.102.1.1-4ubuntu0.16.04.112.1.1-4ubuntu0.16.04.12 |
2.1.1-4ubuntu0.16.04.12+esm1 |
libgd2Ubuntu:18.04:LTS |
before 2.2.5-4ubuntu0.5, plus listed versions 2.2.5-32.2.5-42.2.5-4ubuntu0.22.2.5-4ubuntu0.32.2.5-4ubuntu0.4 |
2.2.5-4ubuntu0.5 |
libgd2Ubuntu:20.04:LTS |
before 2.2.5-5.2ubuntu2.1, plus listed versions 2.2.5-5.22.2.5-5.2ubuntu2 |
2.2.5-5.2ubuntu2.1 |
libgd2Ubuntu:22.04:LTS |
before 2.3.0-2ubuntu1 | 2.3.0-2ubuntu1 |
libgd2Ubuntu:Pro:14.04:LTS From an advisory covering 3 CVEs |
before 2.1.0-3ubuntu0.11+esm2, plus listed versions 2.1.0-22.1.0-32.1.0-3ubuntu0.12.1.0-3ubuntu0.22.1.0-3ubuntu0.3 Show 7 moreShow less2.1.0-3ubuntu0.52.1.0-3ubuntu0.62.1.0-3ubuntu0.72.1.0-3ubuntu0.82.1.0-3ubuntu0.102.1.0-3ubuntu0.112.1.0-3ubuntu0.11+esm1 |
2.1.0-3ubuntu0.11+esm2 |
libgd2Ubuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 2.1.1-4ubuntu0.16.04.12+esm1, plus listed versions 2.1.1-4build12.1.1-4build22.1.1-4ubuntu0.16.04.12.1.1-4ubuntu0.16.04.22.1.1-4ubuntu0.16.04.3 Show 7 moreShow less2.1.1-4ubuntu0.16.04.52.1.1-4ubuntu0.16.04.62.1.1-4ubuntu0.16.04.72.1.1-4ubuntu0.16.04.82.1.1-4ubuntu0.16.04.102.1.1-4ubuntu0.16.04.112.1.1-4ubuntu0.16.04.12 |
2.1.1-4ubuntu0.16.04.12+esm1 |
libgd2Ubuntu:18.04:LTS From an advisory covering 3 CVEs |
before 2.2.5-4ubuntu0.5, plus listed versions 2.2.5-32.2.5-42.2.5-4ubuntu0.22.2.5-4ubuntu0.32.2.5-4ubuntu0.4 |
2.2.5-4ubuntu0.5 |
libgd2Ubuntu:20.04:LTS From an advisory covering 3 CVEs |
before 2.2.5-5.2ubuntu2.1, plus listed versions 2.2.5-5.22.2.5-5.2ubuntu2 |
2.2.5-5.2ubuntu2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38115 is a medium vulnerability (CVSS 6.5) in Libgd, published August 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.87%, the 79th percentile. Fixed in gd 2.2.5-r4.
References
github.com/libgd/libgd/issues/697
lists.debian.org/debian-lts-announce/2024/04/msg00003.html
nvd.nist.gov/vuln/detail/CVE-2021-38115
security.alpinelinux.org/vuln/CVE-2021-38115
Show 13 moreShow less
docs.bell-sw.com/security/cves/CVE-2021-38115
errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459219
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777301041.html
security-tracker.debian.org/tracker/CVE-2021-38115
advisories.mageia.org/MGASA-2021-0433.html
bugs.mageia.org/show_bug.cgi?id=29448
ubuntu.com/security/notices/USN-5068-1
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1315
cve.org/CVERecord?id=CVE-2021-38115