High
Security advisory
Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-9933
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:11 UTC · Revision 1
Source evidence
Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.
osv:CVE-2016-9933
Complete source record
{
"id": "f8af95e1bfa5329da137d64eb7be95991aea6c440213aa814456591a45991e56",
"url": "https://osv.dev/vulnerability/CVE-2016-9933",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-9933",
"summary": "Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.",
"evidence": "osv:CVE-2016-9933",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-9933",
"aliases": [
"CVE-2016-9933"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libgd/libgd",
"type": "GIT",
"events": [
{
"introduced": "a49ebbf1ed370c8d9bf0c30f35050ba2040eee5b"
},
{
"last_affected": "a49ebbf1ed370c8d9bf0c30f35050ba2040eee5b"
},
{
"fixed": "77f619d48259383628c3ec4654b1ad578e9eb40e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libgd:libgd:2.2.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.2.1"
},
{
"last_affected": "2.2.1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "77f619d48259383628c3ec4654b1ad578e9eb40e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"2.2.1",
"gd-2.2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9933.json",
"vanir_signatures": [
{
"id": "CVE-2016-9933-0ad2ad76",
"digest": {
"length": 1578,
"function_hash": "51851102624442393955613366683884704211"
},
"source": "https://github.com/libgd/libgd/commit/77f619d48259383628c3ec4654b1ad578e9eb40e",
"target": {
"file": "src/gd.c",
"function": "gdImageFillToBorder"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-9933-d8ddcde0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57749089167143626458798823933147928600",
"121404800837027207503918118032884996150",
"214785165878694708727711374079984772155",
"177786475786199882260886250082204468426",
"192487108250425406850418729855460599379",
"120103679383625323170182334970288533301"
]
},
"source": "https://github.com/libgd/libgd/commit/77f619d48259383628c3ec4654b1ad578e9eb40e",
"target": {
"file": "src/gd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:19:01Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/php/php-src",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "863d37ea66d5c960db08d6f4a2cbd2518f0f80d1"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "863d37ea66d5c960db08d6f4a2cbd2518f0f80d1"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9933.json",
"vanir_signatures": [
{
"id": "CVE-2016-9933-3344d009",
"digest": {
"length": 1700,
"function_hash": "204555986885295926445620285353660811254"
},
"source": "https://github.com/php/php-src/commit/863d37ea66d5c960db08d6f4a2cbd2518f0f80d1",
"target": {
"file": "ext/gd/libgd/gd.c",
"function": "gdImageFillToBorder"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-9933-95ab2d49",
"digest": {
"threshold": 0.9,
"line_hashes": [
"212289127705669442614260577537722716247",
"213634916113294883352746733094991011668",
"187076187851435916055087938545543830861",
"169292344746694247268202568092638681361"
]
},
"source": "https://github.com/php/php-src/commit/863d37ea66d5c960db08d6f4a2cbd2518f0f80d1",
"target": {
"file": "ext/gd/libgd/gd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:19:01Z"
}
}
],
"modified": "2026-10-20T13:19:01.214398800Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2018:1296",
"https://bugs.php.net/bug.php?id=72696",
"https://github.com/libgd/libgd/issues/215",
"https://github.com/php/php-src/commit/863d37ea66d5c960db08d6f4a2cbd2518f0f80d1",
"https://github.com/libgd/libgd/commit/77f619d48259383628c3ec4654b1ad578e9eb40e"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2016-9933",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387489,
"published_at": "2017-01-04T20:59:00.48+00:00"
}