LiveActive security incident?Get immediate response
CVE Record

CVE-2019-11038: Uninitialized read in gdImageCreateFromXbm

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

LowCVSS 3.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A malformed XBM image processed through PHP's GD image support can expose leftover stack memory from the server process. The known impact is limited confidentiality leakage, not remote code execution. It matters most for systems that accept or transform untrusted images using affected PHP/GD versions.

Executive priority

Treat this as a low-priority patching item unless affected systems process untrusted images on internet-facing services. It should be included in routine maintenance, with faster action for upload-heavy applications handling sensitive data.

Technical view

CVE-2019-11038 is an uninitialized read in LibGD's gdImageCreateFromXbm(), used by PHP GD extension versions 7.1.x before 7.1.30, 7.2.x before 7.2.19, and 7.3.x before 7.3.6. Crafted input may cause use of an uninitialized variable and leak stack contents left by prior code.

Likely exposure

Exposure is most likely in web applications running affected PHP versions with GD enabled and processing user-supplied XBM image data. Systems not using PHP GD image handling, not accepting untrusted images, or already on vendor-patched packages are less exposed.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation. CVSS indicates network reachability but high attack complexity and required user interaction. The supported impact is limited confidentiality loss through possible stack data disclosure.

Researcher notes

Evidence supports an uninitialized read and potential stack disclosure, but not integrity loss, availability impact, or active exploitation. Validate exposure by matching PHP/GD versions and actual XBM processing paths rather than assuming every PHP deployment is affected.

Mitigation direction

  • Upgrade PHP beyond the listed affected versions or install vendor-patched packages.
  • Apply relevant Debian, Fedora, Red Hat, SUSE, or Ubuntu security updates where applicable.
  • Check current vendor guidance for any distribution-specific backports.
  • Restrict untrusted XBM image processing where operationally feasible.
  • Prioritize internet-facing upload or image transformation services first.

Validation and detection

  • Inventory PHP versions and identify systems with the GD extension enabled.
  • Check for PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, or 7.3.x < 7.3.6.
  • Confirm operating-system packages include the relevant vendor security update.
  • Review application paths where untrusted XBM images reach GD processing.
  • Record compensating controls if patching is delayed.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-457: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-11038 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
3.1 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
18Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
3.1CVSS 3.0LowCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N1.61.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

3.1Low
CVSS 3.0 vector shape for CVE-2019-11038Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
PHP GroupPHP7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6Listed
Weakness

CWE details

CWE-457

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-457 · source CWE mapping

Use of Uninitialized Variable

Use of Uninitialized Variable represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs