CVE-2015-8877: Libgd

High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days.

The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.

Affected products

• Libgd Libgd: up to and including 2.1.1
• PHP PHP: up to and including 5.6.11

Published 2016-05-22. Last modified 2026-06-17.