CVE-2019-11932 — android-gif-drawable Double Free vulnerability

Description

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.

Affected products

Vendor	Product	Affected	Fixed
koral--	android-gif-drawable	unspecified – < 1.2.18	1.2.18

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Whatsapp 2.19.216 - Remote Code Execution EDB-47515 · remote · Oct 16, 2019

GitHub 16 repositories · most starred shown

dorkerdevil/CVE-2019-11932 ★ 267 · Oct 3, 2019

double-free bug in WhatsApp exploit poc
awakened1712/CVE-2019-11932 ★ 209 · Oct 4, 2019

Simple POC for exploiting WhatsApp double-free bug in DDGifSlurp in decoding.c in libpl_droidsonroids_gif
valbrux/CVE-2019-11932-SupportApp ★ 38 · Oct 16, 2019

This native code file aims to be complementary to the published Whatsapp GIF RCE exploit by Awakened , by calculating the system() function address and ROP gadget address for different types of devic…
Err0r-ICA/WhatsPayloadRCE ★ 35 · Apr 22, 2020

Whatsapp Automatic Payload Generator [CVE-2019-11932]
kal1gh0st/WhatsAppHACK-RCE ★ 29 · Mar 19, 2021

Whatsapp remote code execution CVE-2019-11932 https://awakened1712.github.io/hacking/hacking-whatsapp-gif-rce/
fastmo/CVE-2019-11932 ★ 18 · Oct 16, 2019

Programa para hackear Whatsapp Mediante Gif ,asiendo un exploit con el puerto.
mRanonyMousTZ/CVE-2019-11932-whatsApp-exploit ★ 16 · Oct 23, 2019

Double-free vulnerability in DDGifSlurp in decoding.c in libpl_droidsonroids_gif can read more https://awakened1712.github.io/hacking/hacking-whatsapp-gif-rce/
SmoZy92/CVE-2019-11932 ★ 6 · Dec 15, 2019
TulungagungCyberLink/CVE-2019-11932 ★ 4 · Oct 5, 2019

Double-Free BUG in WhatsApp exploit poc.
JasonJerry/WhatsRCE ★ 4 · Oct 4, 2019

This is a Automated Generate Payload for CVE-2019-11932 (WhatsApp Remote Code Execution)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	pl.droidsonroids.gif:android-gif-drawable	< 1.2.18	1.2.18	GHSA-x534-j49x-mqvj

android-gif-drawable Double Free vulnerability