Description
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libwmf | 0.2.8.4-2 | — |
| Debian 13 | libwmf | 0.2.8.4-2 | — |
| Debian 12 | libwmf | 0.2.8.4-2 | — |
| Debian 3.1 | libwmf | 0.2.8.3-2sarge1 | DSA-1194-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | libwmf +1 | 0.2.8.3-5.3 | RHSA-2006:0597 |
Advisories 2
- RHSA-2006:0597 Red Hat Security Advisory: libwmf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1194-1 libwmf Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20060630 libwmf integer/heap overflow mailing-list
- oval:org.mitre.oval:def:10262 vdb-entry signature
- 20921 third-party-advisory
- libwmf-wmf-bo(27516) vdb-entry
- 1016518 vdb-entry
- 21473 third-party-advisory
- 22311 third-party-advisory
- USN-333-1 vendor-advisory
- 1190 third-party-advisory
- 21459 third-party-advisory
- 18751 vdb-entry
- SUSE-SR:2006:019 vendor-advisory
- 21064 third-party-advisory
- ADV-2006-2646 vdb-entry
- DSA-1194 vendor-advisory
- 21261 third-party-advisory
- MDKSA-2006:132 vendor-advisory
- 21419 third-party-advisory
- RHSA-2006:0597 vendor-advisory
- GLSA-200608-17 vendor-advisory