Every CVE Search/ Get API key

CVE-2018-1000222

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function...

8.8 HighFix available

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.20%Up 1.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Record
CVE-2018-1000222
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-415
Updated
2026-11-02
CVE List No score

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Record
CVE-2018-1000222
Updated
2026-11-02
EUVDEUVD-2018-1892 No score

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Record
EUVD-2018-1892
Updated
2026-11-03
GitHub AdvisoriesGHSA-jcj9-h5mg-pr5c 8.8

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function...

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Record
GHSA-jcj9-h5mg-pr5c
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-415
Updated
2026-11-02
OSVALPINE-CVE-2018-1000222 8.8

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Record
ALPINE-CVE-2018-1000222
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2018-1000222 8.8

CVE-2018-1000222 does not affect BellSoft software

Record
BELL-CVE-2018-1000222
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 12 moreShow less
OSV 8.8

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Record
CVE-2018-1000222
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-1000222 8.8

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Record
DEBIAN-CVE-2018-1000222
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-1000222 8.8

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Record
UBUNTU-CVE-2018-1000222
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0367 No score

Updated libgd packages fix security vulnerabilities

The updated packages fix security vulnerabilities:

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx (CVE-2018-5711).

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free (CVE-2018-1000222).

Record
MGASA-2018-0367
Updated
2026-11-02
OSVopenSUSE-SU-2024:10777-1 No score

gd-2.3.3-1.1 on GA media

These are all security issues fixed in the gd-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10777-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11167-1 No score

php7-7.4.24-1.1 on GA media

These are all security issues fixed in the php7-7.4.24-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11167-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11169-1 No score

php8-8.0.11-1.1 on GA media

These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11169-1
Updated
2026-11-02
OSVSUSE-SU-2018:2837-1 No score

Security update for gd

This update for gd fixes the following issues:

Security issue fixed:

  • CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434)
Record
SUSE-SU-2018:2837-1
Updated
2026-11-02
OSVSUSE-SU-2018:2840-1 No score

Security update for php7

This update for php7 fixes the following issues:

Security issue fixed:

  • CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434)
Record
SUSE-SU-2018:2840-1
Updated
2026-11-02
OSVSUSE-SU-2018:2888-1 No score

Security update for gd

This update for gd fixes the following issues:

Security issue fixed:

  • CVE-2018-1000222: Fixed a double free vulnerability in gdImageBmpPtr() that could result in remote code execution. This could have been exploited via a specially crafted JPEG image files. (bsc#1105434)
Record
SUSE-SU-2018:2888-1
Updated
2026-11-02
OSVSUSE-SU-2022:4067-1 No score

Security update for php7

This update for php7 fixes the following issues:

  • Version update to 7.2.34 [jsc#SLE-23639]

  • CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

  • Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

Record
SUSE-SU-2022:4067-1
Updated
2026-11-02
OSVUSN-3755-1 No score

libgd2 vulnerabilities

It was discovered that GD incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-1000222)

It was discovered that GD incorrectly handled certain GIF files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-5711)

Record
USN-3755-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gd
Alpine:v3.10
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.11
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.12
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.13
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.14
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.15
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.16
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.17
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.18
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.19
 before 2.2.5-r1
2.2.5-r1
Show 40 moreShow less
Affected packages
PackageAffectedFixed
gd
Alpine:v3.20
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.21
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.22
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.23
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.24
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.5
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.6
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.7
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.8
 before 2.2.5-r1
2.2.5-r1
gd
Alpine:v3.9
 before 2.2.5-r1
2.2.5-r1
libgd2
Debian:12
 before 2.2.5-4.1
2.2.5-4.1
libgd2
Debian:13
 before 2.2.5-4.1
2.2.5-4.1
libgd2
Debian:14
 before 2.2.5-4.1
2.2.5-4.1
libgd2
Debian:8
 before 2.1.0-5+deb8u12, plus listed versions
2.1.0-52.1.0-5+deb8u12.1.0-5+deb8u102.1.0-5+deb8u112.1.0-5+deb8u2
Show 7 moreShow less
2.1.0-5+deb8u32.1.0-5+deb8u42.1.0-5+deb8u52.1.0-5+deb8u62.1.0-5+deb8u72.1.0-5+deb8u82.1.0-5+deb8u9
2.1.0-5+deb8u12
libgd
Mageia:6
 before 2.2.5-2.1.mga6
2.2.5-2.1.mga6
gd
SUSE:Linux Enterprise Desktop 12 SP3
 before 2.1.0-24.9.1
2.1.0-24.9.1
gd
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 2.1.0-24.9.1
2.1.0-24.9.1
gd
SUSE:Linux Enterprise Server 12 SP3
 before 2.1.0-24.9.1
2.1.0-24.9.1
gd
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.1.0-24.9.1
2.1.0-24.9.1
gd
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 2.1.0-24.9.1
2.1.0-24.9.1
php7
SUSE:Linux Enterprise Module for Web and Scripting 15
 before 7.2.5-4.9.1
7.2.5-4.9.1
gd
SUSE:Linux Enterprise Module for Basesystem 15
 before 2.2.5-4.3.1
2.2.5-4.3.1
gd
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 2.2.5-4.3.1
2.2.5-4.3.1
php7
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server 15-LTSS
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server for SAP Applications 15
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Enterprise Storage 6
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
openSUSE:Leap 15.4
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
libgd2
Ubuntu:14.04:LTS
 before 2.1.0-3ubuntu0.10, plus listed versions
2.1.0-22.1.0-32.1.0-3ubuntu0.12.1.0-3ubuntu0.22.1.0-3ubuntu0.3
Show 4 moreShow less
2.1.0-3ubuntu0.52.1.0-3ubuntu0.62.1.0-3ubuntu0.72.1.0-3ubuntu0.8
2.1.0-3ubuntu0.10
libgd2
Ubuntu:16.04:LTS
 before 2.1.1-4ubuntu0.16.04.10, plus listed versions
2.1.1-4build12.1.1-4build22.1.1-4ubuntu0.16.04.12.1.1-4ubuntu0.16.04.22.1.1-4ubuntu0.16.04.3
Show 4 moreShow less
2.1.1-4ubuntu0.16.04.52.1.1-4ubuntu0.16.04.62.1.1-4ubuntu0.16.04.72.1.1-4ubuntu0.16.04.8
2.1.1-4ubuntu0.16.04.10
libgd2
Ubuntu:18.04:LTS
 before 2.2.5-4ubuntu0.2, plus listed versions
2.2.5-32.2.5-4
2.2.5-4ubuntu0.2
gd
openSUSE:Tumbleweed
 before 2.3.3-1.1
2.3.3-1.1
php7
openSUSE:Tumbleweed
 before 7.4.24-1.1
7.4.24-1.1
php8
openSUSE:Tumbleweed
 before 8.0.11-1.1
8.0.11-1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1000222 is a high vulnerability (CVSS 8.8) in Libgd, published August 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.20%, the 90th percentile. Fixed in gd 2.2.5-r1.

References

Show 152 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open