LiveActive security incident?Get immediate response
CVE Record

CVE-2021-38115: read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to...

read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

LibGD through 2.3.2 can read past valid memory while parsing a crafted TGA image. Systems that process attacker-supplied images could crash or become unreliable, creating a denial-of-service risk. The supplied sources do not show data theft, code execution, or confirmed active exploitation.

Executive priority

Prioritize remediation for internet-facing or customer-facing image processing services. For internal-only systems without TGA handling, urgency is lower. The main business risk is service disruption, not confirmed compromise, based on the supplied evidence.

Technical view

The flaw is in read_header_tga in gd_tga.c. A malformed TGA file can trigger an out-of-bounds read during header processing, causing denial of service. The public references include a libgd issue, a fixing commit, and a Debian LTS libgd2 security update.

Likely exposure

Exposure is most likely where LibGD or distro libgd2 processes untrusted TGA files, such as upload handlers, image conversion services, CMS plugins, or batch media pipelines. The source bundle only names LibGD through 2.3.2 and Debian libgd2 updates.

Exploitation context

The CVE record describes remote denial of service via a crafted TGA file. CISA KEV status is false in the bundle, and no cited source claims active exploitation. Evidence supports crash-oriented risk, not broader compromise.

Researcher notes

Focus validation on TGA parsing paths and dependency provenance. Distro packages may carry backported fixes, so version strings alone can mislead. The supplied bundle lacks CVSS, CWE, and detailed affected-package metadata, so exposure must be confirmed locally.

Mitigation direction

  • Apply LibGD or operating-system vendor security updates for affected libgd/libgd2 packages.
  • For Debian LTS systems, review and apply the DLA 3781-1 libgd2 update.
  • Confirm bundled or statically linked LibGD copies are also updated.
  • Route untrusted TGA processing only through patched components.
  • Check vendor guidance before relying on format filtering as mitigation.

Validation and detection

  • Inventory servers, containers, and applications using LibGD or libgd2.
  • Check whether any public workflow accepts or transforms TGA images.
  • Verify installed or bundled LibGD is newer than 2.3.2 or vendor-patched.
  • Review crash logs around image parsing services for suspicious TGA-related failures.
  • Confirm dependency scanners include OS packages and embedded libraries.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-38115 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.