# CVE-2016-6911: libgd out-of-bounds read in dynamicGetbuf

Source: https://junglewise.ai/threats/cve-2016-6911-libgd-out-of-bounds-read-in-dynamicgetbuf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-26. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-6911 · Severity: medium · CVSS 5.5 · Published 2017-01-26

The GD Graphics Library (libgd), a widely used tool for programmatically creating and manipulating images, contains a vulnerability when processing TIFF files. An attacker can provide a specially crafted TIFF image that, when opened by an application using this library, causes the application to crash. This results in a denial of service, potentially disrupting web services or applications that automate image processing.

Technologies: [Libgd](https://junglewise.ai/threats/technologies/libgd). Vendors: [Libgd](https://junglewise.ai/threats/vendors/libgd).

## Quick answers

**Is CVE-2016-6911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-6911 being exploited in the wild.

**How severe is CVE-2016-6911?** Medium severity, with a CVSS score of 5.5, published 26 January 2017.

**Which products and versions are affected?** libgd libgd before 2.2.4.

**Is there a fix for CVE-2016-6911?** A patch was published on 2017-01-18: libgd 2.2.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-6911 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2016-6911?** Check whether you run Libgd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the dynamicGetbuf function within libgd's TIFF processing logic. The root cause is a failure to validate buffer boundaries when handling image data, specifically allowing for negative or excessively large offsets in the dp->pos pointer. When an application calls gdImageCreateFromTiffPtr() with a malformed TIFF file, the library may attempt to read memory outside the allocated buffer, leading to a crash (denial of service). The vulnerability was addressed in version 2.2.4 by adding bounds checks to dynamicGetbuf and ensuring the return value of TIFFReadRGBAImage is properly validated.

## Affected products

- libgd libgd before 2.2.4

## Timeline

- 2016-08-02: other: Internal patch developed by maintainers
- 2016-10-14: advisory: Debian security advisory DSA-3693-1 published
- 2017-01-26: disclosed: NVD publication date
- 2017-01-18: patched: libgd 2.2.4 released with fix

## References

- [http://www.debian.org/security/2016/dsa-3693](http://www.debian.org/security/2016/dsa-3693)
- [http://www.securityfocus.com/bid/95840](http://www.securityfocus.com/bid/95840)
- [https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md](https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md)
- [https://github.com/libgd/libgd/commit/4859d69e07504d4b0a4bdf9bcb4d9e3769ca35ae](https://github.com/libgd/libgd/commit/4859d69e07504d4b0a4bdf9bcb4d9e3769ca35ae)
- [https://github.com/libgd/libgd/pull/353](https://github.com/libgd/libgd/pull/353)

## Related threats

- [libgd denial of service in gdImageCreate](https://junglewise.ai/threats/cve-2016-9317-libgd-denial-of-service-in-gdimagecreate)
- [libgd double free in gdImageWebPtr](https://junglewise.ai/threats/cve-2016-6912-libgd-double-free-in-gdimagewebptr)