CVE-2009-1364: Francis James Franklin Libwmf

High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.

Affected products

• Francis James Franklin Libwmf: version 0.2.8.4 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only

Published 2009-05-01. Last modified 2026-06-16.