CVE-2018-13420
** DISPUTED ** Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to...
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
- Record
CVE-2018-13420- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-772
- Updated
- 2026-11-02
CVE List No score
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
- Record
CVE-2018-13420- Updated
- 2026-11-02
EUVDEUVD-2018-5363 No score
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
- Record
EUVD-2018-5363- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jc8c-gg53-wcm7
** DISPUTED ** Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to...
** DISPUTED ** Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program.
- Record
GHSA-jc8c-gg53-wcm7- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-02
OSVAZL-6453
CVE-2018-13420 affecting package gperftools for versions less than 2.7-4
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
- Record
AZL-6453- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
- Record
CVE-2018-13420- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-13420
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
- Record
DEBIAN-CVE-2018-13420- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-13420
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
- Record
UBUNTU-CVE-2018-13420- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gperftoolsAzure Linux:2 |
before 2.7-4 | 2.7-4 |
google-perftoolsDebian:12 |
All versions, plus listed versions 2.10-12.11-12.12-12.12-22.13-1 Show 10 moreShow less2.15-12.15-1.12.15-1.1~exp12.15-22.15-32.16-12.18-12.18.1-12.18.1-1+alpha2.18.1-2 |
None known |
google-perftoolsDebian:13 |
All versions, plus listed versions 2.16-12.18-12.18.1-12.18.1-1+alpha2.18.1-2 |
None known |
google-perftoolsDebian:14 |
All versions, plus listed versions 2.16-12.18-12.18.1-12.18.1-1+alpha2.18.1-2 |
None known |
google-perftoolsUbuntu:16.04:LTS |
All versions, plus listed versions 2.4-0ubuntu42.4-0ubuntu52.4-0ubuntu5.16.04.1 |
None known |
google-perftoolsUbuntu:18.04:LTS |
All versions, plus listed versions 2.5-2.2ubuntu12.5-2.2ubuntu3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-13420 is a high vulnerability (CVSS 7.5) in Gperftools Project Gperftools, published July 7, 2018. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in gperftools 2.7-4.