Libgd is a compact but widely embedded image-processing library that, despite a narrow product footprint, sits deep in the software supply chain of web applications, content management systems, and graphics tools. Vulnerabilities affecting the library skew toward serious outcomes, with a meaningful share reaching critical severity and a moderate tendency to acquire public exploit code. The exposure recurs through memory-safety and input-handling weakness classes—including out-of-bounds reads, buffer-boundary violations, double frees, and integer overflows—that are characteristic of C image parsers and graphics renderers. Defenders should inventory downstream products that link this library rather than tracking the library alone, since remediation typically depends on those applications rebuilding and releasing updates. Current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Libgd over time
Signals from CVEs in this vendor scope (39 CVEs).
39 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-6977HIGH gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7. | Jan 27, 2019 | 8.8 | 70 | NO | YES |
CVE-2016-3074CRITICAL Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via c | Apr 26, 2016 | 9.8 | 65 | NO | YES |
CVE-2016-10166CRITICAL Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact | Mar 15, 2017 | 9.8 | 35 | NO | NO |
CVE-2016-7568CRITICAL Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a | Sep 28, 2016 | 9.8 | 34 | NO | NO |
CVE-2009-3546HIGH The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which m | Oct 19, 2009 | 9.3 | 34 | NO | NO |
CVE-2016-5766HIGH Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7. | Aug 7, 2016 | 8.8 | 31 | NO | NO |
CVE-2016-5116CRITICAL gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information | Aug 7, 2016 | 9.1 | 29 | NO | NO |
CVE-2018-1000222HIGH Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via | Aug 20, 2018 | 8.8 | 28 | NO | NO |
CVE-2016-9933HIGH Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, | Jan 4, 2017 | 7.5 | 28 | NO | NO |
CVE-2016-10168HIGH Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal an | Mar 15, 2017 | 7.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (39 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Libgd.
Media articles that mention a CVE ID that affects a product developed by Libgd — matched by CVE ID, not by vendor name.