{
  "threat_severity" : "Important",
  "public_date" : "2026-07-26T00:00:00Z",
  "bugzilla" : {
    "description" : "libgd: buffer overflow when processing specially crafted GIF file",
    "id" : "2533111",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2533111"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-120",
  "details" : [ "A flaw was found in libgd. Processing a specially crafted GIF file allows a remote attacker to trigger a buffer overflow, resulting in an application crash and a denial of service. Arbitrary code execution is possible in theory, but considered highly unlikely because standard image decompression and pixel manipulation generally destroy the exploit payload." ],
  "statement" : "To exploit this flaw, a remote attacker needs to be able to process a crafted GIF file with an application linked to the libgd library. Successful exploitation can result in an application crash, leading to a denial of service, or in arbitrary code execution. However, arbitrary code execution is highly unlikely because standard image decompression and pixel manipulation generally destroy the exploit payload.\nFor these reasons, this vulnerability has been rated with an important severity.\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) memory protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-10-12T00:00:00Z",
    "advisory" : "RHSA-2026:81518",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "gd-0:2.3.3-20.el10_2.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-10-12T00:00:00Z",
    "advisory" : "RHSA-2026:80500",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "gd-0:2.3.3-20.el10_0.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-10-05T00:00:00Z",
    "advisory" : "RHSA-2026:75680",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "gd-0:2.2.5-8.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:85102",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "gd-0:2.2.5-7.el8_4.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:85102",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "gd-0:2.2.5-7.el8_4.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:85099",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "gd-0:2.2.5-7.el8_6.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:85099",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.6",
    "package" : "gd-0:2.2.5-7.el8_6.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:85132",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "gd-0:2.2.5-7.el8_8.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:85132",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "gd-0:2.2.5-7.el8_8.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-10-12T00:00:00Z",
    "advisory" : "RHSA-2026:81517",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "gd-0:2.3.2-3.el9_8.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:84581",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "gd-0:2.3.2-3.el9_2.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:84580",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "gd-0:2.3.2-3.el9_4.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-10-19T00:00:00Z",
    "advisory" : "RHSA-2026:84579",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "gd-0:2.3.2-3.el9_6.1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-09-15T00:00:00Z",
    "advisory" : "RHSA-2026:67635",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "gd-main-2.3.3-22.1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "libwmf",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "nautilus",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "php8.4",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Affected",
    "package_name" : "gd",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Affected",
    "package_name" : "php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "gd",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "gnome-photos",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "php:7.4/php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "php:8.2/php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "gnome-photos",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "libwmf",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "nautilus",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "php:8.2/php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "php:8.3/php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "php:8.4/php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "php",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-9672\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-9672\nhttps://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315" ],
  "name" : "CVE-2026-9672",
  "mitigation" : {
    "value" : "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
    "lang" : "en:us"
  },
  "csaw" : false
}