Enlightenment maintains a specialized set of image rendering and display libraries and a window manager that, despite a narrow product roster, occupy a foundational role in multimedia and graphical rendering pipelines on Unix-like systems. The vendor's vulnerability exposure concentrates in image-processing components such as Imlib2 and Imlib, where a meaningful share of disclosures reach serious severity and a moderate tendency emerges toward public exploit availability, reflecting the complexity and attack surface inherent to image decoding and manipulation. Recurring weakness classes center on memory-safety issues—out-of-bounds writes, improper buffer-boundary restrictions, and improper input validation—consistent with the low-level parsing and pixel-buffer operations that characterize image libraries. Defenders should track this vendor's updates closely for systems that expose image rendering functionality or rely on these libraries as dependencies in media or graphical applications; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Enlightenment over time
Signals from CVEs in this vendor scope (32 CVEs).
32 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-37706HIGH enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin wi | Dec 25, 2022 | 7.8 | 48 | NO | YES |
CVE-2016-4024CRITICAL Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap | May 13, 2016 | 9.8 | 33 | NO | NO |
CVE-2004-1025HIGH Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a denial of service (applica | Jan 10, 2005 | 10.0 | 32 | NO | NO |
CVE-2004-1026HIGH Multiple integer overflows in the image handler for imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a denial of serv | Jan 10, 2005 | 10.0 | 32 | NO | NO |
CVE-2016-3994HIGH The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers a | May 13, 2016 | 8.2 | 27 | NO | NO |
CVE-2018-20167HIGH Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used. A popmedia control se | Dec 17, 2018 | 7.8 | 25 | NO | NO |
CVE-2016-3993HIGH Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (out-of-bounds read and applicatio | May 13, 2016 | 7.5 | 25 | NO | NO |
CVE-2011-5326HIGH imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse. | May 13, 2016 | 7.5 | 25 | NO | NO |
CVE-2008-6079HIGH imlib2 before 1.4.2 allows context-dependent attackers to have an unspecified impact via a crafted (1) ARGB, (2) BMP, (3) JPEG, (4) LBM, (5) PNM, (6) TGA, or (7) XPM file, related | Feb 6, 2009 | 10.0 | 25 | NO | NO |
CVE-2024-25450HIGH imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts(). | Feb 9, 2024 | 8.8 | 24 | NO | NO |
Signals from CVEs in this vendor scope (32 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Enlightenment.
Media articles that mention a CVE ID that affects a product developed by Enlightenment — matched by CVE ID, not by vendor name.