CVE-2018-3977

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-11-01 · updated 2026-06-17
Weakness: CWE-787

Description

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Affected products

libsdl-org SDL_image: 2.0.3

References

https://lists.debian.org/debian-lts-announce/2019/07/msg00021.html
https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html
https://security.gentoo.org/glsa/201903-17
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0645
https://usn.ubuntu.com/4238-1/
https://lists.debian.org/debian-lts-announce/2019/07/msg00021.html
https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html
https://security.gentoo.org/glsa/201903-17
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0645
https://usn.ubuntu.com/4238-1/

Get alerted when CVE-2018-3977 or the next vulnerability affects your stack