CVE-2020-37239

libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature field upon freeing, enabling potential memory corruption and code execution.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.exploit-db.com/exploits/49259
https://www.gegl.org
https://www.gegl.org/babl/
https://www.vulncheck.com/advisories/libbabl-broken-double-free-detection-memory-safety

Configurations

No configuration.

History

29 Sep 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) libbabl 0.1.62 contiene una vulnerabilidad de detección de doble liberación fallida que permite a los atacantes eludir las comprobaciones de seguridad de la memoria explotando la sobrescritura de firmas en bloques liberados. Los atacantes pueden llamar a babl_free() dos veces sobre el mismo puntero sin activar la detección, ya que los metadatos de malloc de libc sobrescriben el campo de firma de babl al liberar, lo que permite una potencial corrupción de memoria y ejecución de código.

Information

Published : 2026-05-16 16:16

Updated : 2026-09-29 10:10

NVD link : CVE-2020-37239

Mitre link : CVE-2020-37239

CVE.ORG link : CVE-2020-37239

JSON object : View

Products Affected

No product.

CWE

CWE-415

Double Free

{"id": "CVE-2020-37239", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-37239", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-18T18:08:37.285737Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Gegl", "product": "libbabl", "versions": [{"status": "affected", "version": "0.1.62"}]}]}], "published": "2026-05-16T16:16:20.097", "references": [{"url": "https://www.exploit-db.com/exploits/49259", "source": "disclosure@vulncheck.com"}, {"url": "https://www.gegl.org", "source": "disclosure@vulncheck.com"}, {"url": "https://www.gegl.org/babl/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/libbabl-broken-double-free-detection-memory-safety", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature field upon freeing, enabling potential memory corruption and code execution."}, {"lang": "es", "value": "libbabl 0.1.62 contiene una vulnerabilidad de detecci\u00f3n de doble liberaci\u00f3n fallida que permite a los atacantes eludir las comprobaciones de seguridad de la memoria explotando la sobrescritura de firmas en bloques liberados. Los atacantes pueden llamar a babl_free() dos veces sobre el mismo puntero sin activar la detecci\u00f3n, ya que los metadatos de malloc de libc sobrescriben el campo de firma de babl al liberar, lo que permite una potencial corrupci\u00f3n de memoria y ejecuci\u00f3n de c\u00f3digo."}], "lastModified": "2026-09-29T10:10:00.263", "sourceIdentifier": "disclosure@vulncheck.com"}