Critical Vulnerability in libgd2 and PHP Packages in Debian Distributions
Summary
DEBIAN-CVE-2026-9672: ... Affects libgd2 versions 2.3.0-2 – 2.3.3-9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgd2 is a widely used graphics library for dynamically creating images in various formats, including PNG, JPEG, and GIF. It is utilized in many web applications and services for image processing. PHP, a popular server-side scripting language, often relies on libgd2 for image manipulation tasks. The vulnerability affects multiple versions of these packages across different Debian distributions, potentially compromising applications that depend on them.
Vulnerability Detail
The vulnerability identified as CVE-2026-9672 affects the libgd2 and PHP packages across several Debian distributions. It originates from insufficient validation of input data, which could lead to memory corruption or arbitrary code execution. This vulnerability poses significant risks, including unauthorized access to sensitive data, service disruption, and potential exploitation by attackers to execute malicious code on affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable any features in their applications that utilize the vulnerable libgd2 or PHP packages until updates are applied. This may involve modifying application settings or configurations to prevent the use of image processing functionalities.
Conclusion
The CVE-2026-9672 vulnerability poses serious risks to applications using libgd2 and PHP across various Debian distributions. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Temporary workarounds can be employed until updates are applied.
See every vulnerability recorded for libgd2 →
FAQ
CVE-2026-9672 is a vulnerability affecting libgd2 and PHP packages in Debian distributions, which could lead to memory corruption or arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, consider disabling features that rely on the vulnerable packages as a temporary workaround.
While specific exploits may not be publicly disclosed, the nature of the vulnerability allows for potential exploitation, making it critical to apply updates as soon as possible.
The impacts include unauthorized access to sensitive data, service disruptions, and the risk of attackers executing malicious code on affected systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgd2.
