# CVE-2016-9317: libgd denial of service in gdImageCreate

Source: https://junglewise.ai/threats/cve-2016-9317-libgd-denial-of-service-in-gdimagecreate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-26. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9317 · Severity: medium · CVSS 5.5 · Published 2017-01-26

The GD Graphics Library, a widely used tool for creating and editing images programmatically, contains a flaw in how it handles very large images. An attacker can provide a specially crafted, oversized image that causes the system to hang or become unresponsive. This results in a denial of service, potentially crashing web servers or applications that process user-uploaded images.

Technologies: [Libgd](https://junglewise.ai/threats/technologies/libgd). Vendors: [Libgd](https://junglewise.ai/threats/vendors/libgd).

## Quick answers

**Is CVE-2016-9317 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9317 being exploited in the wild.

**How severe is CVE-2016-9317?** Medium severity, with a CVSS score of 5.5, published 26 January 2017.

**Which products and versions are affected?** libgd libgd before 2.2.4.

**Is there a fix for CVE-2016-9317?** A patch was published on 2017-01-31: Debian released security update DSA-3777-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-9317 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-9317?** Check whether you run Libgd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in libgd's gdImageCreate function due to improper input validation of image dimensions. The function fails to perform overflow checks when allocating memory for new images, a protection that was already present in the related gdImageCreateTrueColor function. By providing an image with extremely large dimensions, a remote attacker can trigger a system hang or resource exhaustion. This issue is resolved in version 2.2.4 by implementing the missing overflow checks.

## Affected products

- libgd libgd before 2.2.4

## Timeline

- 2017-01-26: advisory: NVD publication date
- 2017-01-31: patched: Debian released security update DSA-3777-1

## References

- [http://www.debian.org/security/2017/dsa-3777](http://www.debian.org/security/2017/dsa-3777)
- [http://www.securityfocus.com/bid/95841](http://www.securityfocus.com/bid/95841)
- [https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md](https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md)
- [https://github.com/libgd/libgd/commit/1846f48e5fcdde996e7c27a4bbac5d0aef183e4b](https://github.com/libgd/libgd/commit/1846f48e5fcdde996e7c27a4bbac5d0aef183e4b)

## Related threats

- [libgd double free in gdImageWebPtr](https://junglewise.ai/threats/cve-2016-6912-libgd-double-free-in-gdimagewebptr)
- [libgd out-of-bounds read in dynamicGetbuf](https://junglewise.ai/threats/cve-2016-6911-libgd-out-of-bounds-read-in-dynamicgetbuf)