CVE-2009-3546: The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x,...

Security readout for executives and security teams

CVE-2009-3546 is an old image-processing flaw in PHP’s bundled GD code and the GD Graphics Library. A specially crafted GD image file could trigger memory corruption or over-read behavior. Business impact is mainly for legacy systems that still process untrusted GD files through affected PHP/GD versions. Exposure is most likely in legacy PHP applications or services using GD to ingest user-supplied GD image files. Modern PHP deployments are unlikely affected unless they retain old bundled or system GD libraries. Prioritize this where legacy image upload or conversion services remain online. For fully supported PHP stacks, urgency is low; for exposed PHP 5.2/5.3 systems, remediation should be scheduled promptly because the flaw is memory-safety related. Mitigation focus: Upgrade PHP 5.3.x systems to at least PHP 5.3.1 or vendor-supported fixed packages.; Apply relevant distribution security updates, including Red Hat or Mandriva advisories where applicable.; Identify and retire unsupported PHP 5.2, PHP 5.3, and old GD 2.x deployments..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.