Vulnerability record · CVE-2021-40145 · published 26 August 2021

CVE-2021-40145: Libgd double free vulnerability

Libgd · Libgd

gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.

7.5 CVSS 3.1 High EPSS 2.1% · top 17.7% CWE-415 · Double free

7.5CVSS 3.1 base score, v2 5.0

2.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Libgd Libgd

References

Link	Tags
https://github.com/libgd/libgd/commit/c5fd25ce0e48fd5618a972ca9f5e28d6d62006af	PatchThird Party Advisory
https://github.com/libgd/libgd/issues/700	ExploitIssue TrackingThird Party Advisory
https://github.com/libgd/libgd/pull/713	Issue TrackingThird Party Advisory
https://github.com/libgd/libgd/commit/c5fd25ce0e48fd5618a972ca9f5e28d6d62006af	PatchThird Party Advisory
https://github.com/libgd/libgd/issues/700	ExploitIssue TrackingThird Party Advisory
https://github.com/libgd/libgd/pull/713	Issue TrackingThird Party Advisory

Track CVE-2021-40145 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-6978Libgd double free vulnerabilityThe GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is un…EPSS 4.5%28 Jan 2019 9.8CVE-2016-10166Libgd vulnerabilityInteger underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attac…EPSS 11%15 Mar 2017 9.8CVE-2016-6912Libgd double free vulnerabilityDouble free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecifi…EPSS 4.5%26 Jan 2017 9.8CVE-2016-8670Libgd memory buffer overflow vulnerabilityInteger signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.…EPSS 4.7%4 Jan 2017 9.8CVE-2016-7568Libgd integer overflow vulnerabilityInteger overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, all…EPSS 5.1%28 Sep 2016 9.8CVE-2016-3074Libgd vulnerabilityInteger signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potential…EPSS 36%26 Apr 2016 9.1CVE-2016-5116Libgd memory buffer overflow vulnerabilitygd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers …EPSS 3.8%7 Aug 2016 8.8CVE-2019-6977LibGD gdImageColorMatch heap buffer overflow via PHP imagecolormatchgdImageColorMatch in LibGD 2.2.5, reached through PHP's imagecolormatch function, contains a heap-based buffer overflow (CWE-787 out-of-bounds write)…EPSS 71%analysed27 Jan 2019

Source: NIST National Vulnerability Database (record CVE-2021-40145), CISA KEV, FIRST EPSS (scores of 2026-11-14). This page is refreshed as NVD updates the record.