Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

libwmf 0.2.8.4 lets attackers run code via crafted WMF

CVE-2006-3376 · published 20 years ago
Summary

The libwmf library version 0.2.8.4, used in the wv and wv2 products, can mishandle a specially crafted WMF image file and cause an integer overflow. This flaw can allow a remote attacker to run any code they choose on the affected system. Apply the latest patches or upgrade to a newer libwmf version to close the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wvware libwmf 0.2.8_.4
cpe:2.3:a:wvware:libwmf:0.2.8_.4:*:*:*:*:*:*:*
wvware wv2 0.2.1
0.2.2
0.2.3
cpe:2.3:a:wvware:wv2:0.2.1:*:*:*:*:*:*:*
Original advisory text
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execut...
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
8% chance of attack within 30 days
Timeline
Published6 Jul 2006
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-3376 · NVD
Track software like this
Free during beta