CVE-2016-6911

What it actually does

The vulnerability permits an out-of-bounds read inside the dynamicGetbuf function during TIFF parsing, causing a denial-of-service crash in any application linked against the affected libgd.

Why it matters to the business

Image-processing workloads that accept untrusted TIFF files may experience intermittent crashes and service degradation; however the issue is more than nine years old, carries low exploitation probability, and appears absent from the listed packages, limiting operational exposure.

How an attack unfolds

An attacker creates a malformed TIFF image that triggers the bounds violation in dynamicGetbuf, then supplies the file to any service that invokes libgd’s TIFF decoder, resulting in an immediate crash.

How to fix it

Upgrade libgd to 2.2.4 or newer; the listed pulumi packages on Chainguard and Wolfi already ship non-vulnerable versions (fixed at base version 0) and require no further change.

How to confirm the fix worked

Confirm the installed libgd shared library reports version 2.2.4 or later; reprocess a known-bad TIFF test case and verify the application no longer crashes.

Typical attack path

1. Locate an application or service that uses libgd to decode TIFF images
2. Generate a TIFF file engineered to exercise the vulnerable code path
3. Deliver the crafted image through normal input channels (upload, email attachment, API)
4. Trigger image processing to induce the out-of-bounds read and crash

How to detect it

Search application and system logs for segmentation faults or abrupt process termination immediately after TIFF decoding attempts; no public in-the-wild exploitation artifacts are known.

What your security team should do

• Inventory any remaining direct or transitive use of libgd < 2.2.4
• Block or sanitize TIFF input where possible until libraries are current
• Add the stable low EPSS score and nine-year publication age to risk-acceptance documentation