CVE-2008-2426

Multiple stack-based buffer overflows in Imlib 2 (aka imlib2) 1.4.0 allow user-assisted remote...

9.3 HighFix available

Multiple stack-based buffer overflows in Imlib 2 (aka imlib2) 1.4.0 allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a PNM image with a crafted header, related to the load function in src/modules/loaders/loader_pnm.c; or (2) a crafted XPM image, related to the load function in src/modules/loader_xpm.c.

Exploit likelihood

5.75%Down 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2008-2426
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-2426
Updated: 2026-11-02

EUVDEUVD-2008-2421 No score

Record: EUVD-2008-2421
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vp39-rwgc-h3pg No score

Multiple stack-based buffer overflows in Imlib 2 (aka imlib2) 1.4.0 allow user-assisted remote...

Record: GHSA-vp39-rwgc-h3pg
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Record: CVE-2008-2426
Updated: 2026-11-02

OSVDEBIAN-CVE-2008-2426 No score

Record: DEBIAN-CVE-2008-2426
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10861-1 No score

imlib2-1.7.1-1.6 on GA media

These are all security issues fixed in the imlib2-1.7.1-1.6 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10861-1
Updated: 2026-11-02

Affected products

carsten haitzler imlib2

Affected packages

Affected packages
Package	Affected	Fixed
`imlib2` Debian:12	before 1.4.0-1.1	1.4.0-1.1
`imlib2` Debian:13	before 1.4.0-1.1	1.4.0-1.1
`imlib2` Debian:14	before 1.4.0-1.1	1.4.0-1.1
`imlib2` Debian:4.0	before 1.3.0.0debian1-4+etch1, plus listed versions 1.3.0.0debian1-4	1.3.0.0debian1-4+etch1
`imlib2` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 1.7.1-1.6	1.7.1-1.6

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-2426 is a high vulnerability (CVSS 9.3) in Carsten Haitzler Imlib2, published June 2, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.75%, the 93rd percentile. Fixed in imlib2 1.4.0-1.1.

References

Show 18 moreShow less