CVE-2008-3658: Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5...

Security readout for executives and security teams

This is an old PHP GD image library flaw. If a vulnerable PHP application loads a malicious font file through imageloadfont, PHP may crash and could potentially run attacker-controlled code. The risk is mainly for legacy PHP 4.4.x and PHP 5.2 deployments with reachable font-loading functionality. Exposure is likely limited to legacy systems running vulnerable PHP versions and application code that can be induced to load attacker-supplied or untrusted GD font files. Systems using maintained PHP versions should not normally be exposed, but old bundled PHP packages from operating systems should be verified. Prioritize remediation where legacy PHP is still handling uploaded or user-controlled files. This is not supported by evidence of active exploitation in the provided sources, but the possible code execution impact makes reachable systems important to retire or patch. Mitigation focus: Upgrade PHP beyond the vulnerable versions named in the CVE record.; Apply relevant vendor or distribution PHP security updates.; Remove or disable untrusted font-file loading where possible..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.