CVE-2007-3473: The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote...

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 7, 2024, 14:21 UTC (UTC+00:00)

Analyst readout for executives and security teams

Plain-English summary

CVE-2007-3473 is an old denial-of-service flaw in the GD Graphics Library. If an application uses vulnerable libgd code to process XBM images, a crafted or problematic image could crash the image-processing path. The public bundle does not show code execution, data theft, or active exploitation.

Executive priority

Treat this as a legacy availability risk, not an emergency unless vulnerable image processing is internet-facing or business-critical. Prioritize remediation during normal patch cycles, with faster action for public upload services using old libgd.

Technical view

The issue affects gdImageCreateXbm in libgd before 2.0.35. The CVE describes a crash involving gdImageCreate failure during XBM handling. The exact vectors are unspecified in the provided sources, so exposure analysis should focus on libgd versions and applications that process untrusted XBM/image input.

Likely exposure

Exposure is most likely in legacy systems or bundled applications using libgd before 2.0.35 to process user-uploaded or externally supplied XBM images. The bundle does not identify affected products beyond libgd, and distribution package status may depend on vendor backports.

Exploitation context

The CVE says remote attackers can cause denial of service, but requires user assistance and provides no detailed vector. KEV is false, and the supplied sources do not support claims of active exploitation.

Researcher notes

The source data is sparse: no CVSS, CWE, detailed affected CPEs, or exploit details are provided. The clearest remediation marker is libgd before 2.0.35. Avoid extrapolating impact beyond crash-based denial of service.

Mitigation direction

Upgrade libgd to 2.0.35 or a vendor-fixed package.
Check distro advisories for backported fixes on legacy systems.
Limit or disable untrusted XBM image processing where feasible.
Apply compensating upload validation for unsupported legacy applications.
Monitor vendor guidance for unsupported or bundled libgd copies.

Validation and detection

Inventory installed libgd/GD package versions across servers and containers.
Identify applications that process uploaded or external image files.
Check whether XBM handling is enabled or reachable.
Review crash logs around image parsing services.
Use vendor advisories or OVAL content to confirm package status.

Prepared: Jun 29, 2026, 04:47 UTC (UTC+00:00)
Confidence: medium
Sources: 7

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2007-3473 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jun 28, 2007, 18:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

36Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
gd-imagecreatexbm-dos(35109)CVE reference · vdb-entry, x_refsource_XF
2007-0024CVE reference · vendor-advisory, x_refsource_TRUSTIX
MDKSA-2007:164CVE reference · vendor-advisory, x_refsource_MANDRIVA
29157CVE reference · third-party-advisory, x_refsource_SECUNIA
37744CVE reference · vdb-entry, x_refsource_OSVDB
oval:org.mitre.oval:def:11806CVE reference · vdb-entry, signature
26415CVE reference · third-party-advisory, x_refsource_SECUNIA
https://issues.rpath.com/browse/RPL-1643CVE reference · x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=277421CVE reference · x_refsource_CONFIRM
25855CVE reference · third-party-advisory, x_refsource_SECUNIA
GLSA-200805-13CVE reference · vendor-advisory, x_refsource_GENTOO
20070907 FLEA-2007-0052-1 gdCVE reference · mailing-list, x_refsource_BUGTRAQ
26467CVE reference · third-party-advisory, x_refsource_SECUNIA
42813CVE reference · third-party-advisory, x_refsource_SECUNIA
http://www.libgd.org/ReleaseNote020035CVE reference · x_refsource_CONFIRM
GLSA-200708-05CVE reference · vendor-advisory, x_refsource_GENTOO
30168CVE reference · third-party-advisory, x_refsource_SECUNIA
FEDORA-2007-692CVE reference · vendor-advisory, x_refsource_FEDORA
ADV-2011-0022CVE reference · vdb-entry, x_refsource_VUPEN
25860CVE reference · third-party-advisory, x_refsource_SECUNIA
ADV-2007-2336CVE reference · vdb-entry, x_refsource_VUPEN
26663CVE reference · third-party-advisory, x_refsource_SECUNIA
FEDORA-2010-19033CVE reference · vendor-advisory, x_refsource_FEDORA

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.