CVE-2018-3838

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Cisco Systems, Inc.	Simple DirectMedia	Simple DirectMedia Layer SDL2_image 2.0.2

References

https://security.gentoo.org/glsa/201903-17Third Party Advisory
https://www.debian.org/security/2018/dsa-4177Third Party Advisory
https://www.debian.org/security/2018/dsa-4184Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0520Exploit, Technical Description, Third Party Advisory
https://security.gentoo.org/glsa/201903-17Third Party Advisory
https://www.debian.org/security/2018/dsa-4177Third Party Advisory
https://www.debian.org/security/2018/dsa-4184Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0520Exploit, Technical Description, Third Party Advisory

Timeline

Published: Apr 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-38398.8An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A CVE-2018-38407.5A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). The vulnerability is present in the parsing CVE-2018-38417.5A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x69). The vulnerability is present in the parsing CVE-2018-38428.8An exploitable use of an uninitialized pointer vulnerability exists in the JavaScript engine in Foxit PDF Reader version 9.0.1.1049. A speci CVE-2018-38438.8An exploitable type confusion vulnerability exists in the way Foxit PDF Reader version 9.0.1.1049 parses files with associated file annotati CVE-2018-38448.8In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted DOCX document can lead to a use-after-free resulting in CVE-2018-38458.8In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, a crafted OpenDocument document can lead to a SkCanvas object dou CVE-2018-38468.8In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer over CVE-2018-38478.8Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially cra CVE-2018-38488.8In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwri CVE-2018-38498.8In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwri CVE-2018-38508.8An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially