CVE-2018-10113
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm...
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
- Record
CVE-2018-10113- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
- Record
CVE-2018-10113- Updated
- 2026-11-02
EUVDEUVD-2018-2192 No score
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
- Record
EUVD-2018-2192- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-732f-45j6-wqx9
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm...
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
- Record
GHSA-732f-45j6-wqx9- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
- Record
CVE-2018-10113- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-10113
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
- Record
DEBIAN-CVE-2018-10113- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-10113
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.
- Record
UBUNTU-CVE-2018-10113- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2020:1658-1 No score
Security update for gegl
This update for gegl fixes the following issues:
- CVE-2018-10113: The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure. (bsc#1089731)
- Record
SUSE-SU-2020:1658-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
geglDebian:12 |
before 0.3.34-1 | 0.3.34-1 |
geglDebian:13 |
before 0.3.34-1 | 0.3.34-1 |
geglDebian:14 |
before 0.3.34-1 | 0.3.34-1 |
geglSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 0.2.0-15.3.99 | 0.2.0-15.3.99 |
geglSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 0.2.0-15.3.99 | 0.2.0-15.3.99 |
geglSUSE:Linux Enterprise Workstation Extension 12 SP4 |
before 0.2.0-15.3.99 | 0.2.0-15.3.99 |
geglSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 0.2.0-15.3.99 | 0.2.0-15.3.99 |
geglUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.3.0-4ubuntu20.3.2-1ubuntu10.3.2-1ubuntu20.3.4-1ubuntu10.3.4-1ubuntu20.3.4-1ubuntu2+esm1 |
None known |
geglUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.3.20-10.3.20-30.3.24-10.3.28-30.3.30-10.3.30-1ubuntu10.3.30-1ubuntu1+esm1 |
None known |
geglUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.4.14-10.4.18-1ubuntu10.4.18-20.4.18-2build10.4.22-10.4.22-30.4.22-3ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
geglUbuntu:22.04:LTS |
All versions, plus listed versions 1:0.4.32-11:0.4.32-21:0.4.34-11:0.4.34-1build1 |
None known |
geglUbuntu:24.04:LTS |
All versions, plus listed versions 1:0.4.44-3ubuntu11:0.4.46-41:0.4.48-11:0.4.48-2.4build11:0.4.48-2.4build2 |
None known |
geglUbuntu:25.10 |
All versions, plus listed versions 1:0.4.58-11:0.4.58-21:0.4.62-11:0.4.62-21:0.4.62-31:0.4.62-3.1 |
None known |
geglUbuntu:26.10 |
All versions, plus listed versions 1:0.4.70-11:0.4.70-3build11:0.4.70-4 |
None known |
geglUbuntu:26.04:LTS |
All versions, plus listed versions 1:0.4.62-3.11:0.4.64-11:0.4.64-21:0.4.66-21:0.4.66-31:0.4.68-11:0.4.70-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10113 is a high vulnerability (CVSS 7.5) in Gegl Generic Graphics Library, published April 14, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in gegl 0.3.34-1.
References
github.com/xiaoqx/pocs/tree/master/gegl
nvd.nist.gov/vuln/detail/CVE-2018-10113
security-tracker.debian.org/tracker/CVE-2018-10113
suse.com/support/update/announcement/2020/suse-su-20201658-1
bugzilla.suse.com/1089731
ubuntu.com/security/CVE-2018-10113
cve.org/CVERecord?id=CVE-2018-10113