CVE-2018-3977 is a critical code execution vulnerability affecting SDL2_image-2.0.3, specifically within its XCF image rendering functionality. A specially crafted XCF image can trigger a heap overflow, leading to arbitrary code execution on an affected system. With a CVSS score of 8.8 (High), this vulnerability is remotely exploitable with low attack complexity, requiring user interaction (displaying the malicious image) and potentially leading to high impact across confidentiality, integrity, and availability. While no public exploits (Metasploit, Nuclei, ExploitDB) or active exploitation (KEV) have been identified, and community discussion is minimal, the inherent risk remains significant.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0.3CPE matchmatch criteria | cpe:2.3:a:libsdl:sdl_image:2.0.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.