CVE catalog

CVE-2026-11526

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.35% · Oct 25, 2026

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. _make_filehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory *Data variants do not open a path and are unaffected. Any caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibgd-perlsid2.84-3fixed
Debianlibgd-perlforky2.84-3fixed
Debianlibgd-perltrixie2.78-1+deb13u1fixed
Debianlibgd-perltrixie-security2.78-1+deb13u1fixed
Debianlibgd-perlbookworm2.76-4+deb12u1fixed
Debianlibgd-perlbookworm-security2.76-4+deb12u1fixed
Cpelibgd-perlNot reported2.78-1ubuntu0.24.04.1fixed
Alpineperl-gd3.212.86-r0fixed
Alpineperl-gd3.222.86-r0fixed
Alpineperl-gd3.232.86-r0fixed
Alpineperl-gd3.242.86-r0fixed
Ubuntulibgd-perl22.042.73-1build2vulnerable
Ubuntulibgd-perl22.042.76-2vulnerable
Ubuntulibgd-perl22.042.76-2build1vulnerable
Ubuntulibgd-perl22.042.76-2ubuntu0.1fixed
Ubuntulibgd-perl24.042.76-4build1vulnerable
Ubuntulibgd-perl24.042.78-1vulnerable
Ubuntulibgd-perl24.042.78-1build1vulnerable
Ubuntulibgd-perl24.042.78-1build2vulnerable
Ubuntulibgd-perl24.042.78-1build3vulnerable
Ubuntulibgd-perl24.042.78-1ubuntu0.24.04.1fixed
Ubuntulibgd-perl25.102.78-1build4vulnerable
Ubuntulibgd-perl25.102.78-1ubuntu0.25.10.1fixed
Ubuntulibgd-perl26.042.78-1build4vulnerable
Ubuntulibgd-perl26.042.83-1vulnerable
Ubuntulibgd-perl26.042.84-2vulnerable
Ubuntulibgd-perl26.042.84-2ubuntu0.1fixed
Ubuntulibgd-perl16.042.53-1build1vulnerable
Ubuntulibgd-perl16.042.53-2vulnerable
Ubuntulibgd-perl16.042.53-2build1vulnerable
Ubuntulibgd-perl16.042.53-2.1vulnerable
Ubuntulibgd-perl18.042.66-1build1vulnerable
Ubuntulibgd-perl20.042.71-2vulnerable
Ubuntulibgd-perl20.042.71-2build1vulnerable
Ubuntulibgd-perl22.042.73-1build2vulnerable
Ubuntulibgd-perl22.042.76-2vulnerable
Ubuntulibgd-perl22.042.76-2build1vulnerable
Ubuntulibgd-perl22.042.76-2ubuntu0.1fixed
Ubuntulibgd-perl24.042.76-4build1vulnerable
Ubuntulibgd-perl24.042.78-1vulnerable
Ubuntulibgd-perl24.042.78-1build1vulnerable
Ubuntulibgd-perl24.042.78-1build2vulnerable
Ubuntulibgd-perl24.042.78-1build3vulnerable
Ubuntulibgd-perl24.042.78-1ubuntu0.24.04.1fixed
Ubuntulibgd-perl25.102.78-1build4vulnerable
Ubuntulibgd-perl25.102.78-1ubuntu0.25.10.1fixed
Ubuntulibgd-perl26.042.78-1build4vulnerable
Ubuntulibgd-perl26.042.83-1vulnerable
Ubuntulibgd-perl26.042.84-2vulnerable
Ubuntulibgd-perl26.042.84-2ubuntu0.1fixed
Opensuseperl-GDtumbleweed2.860.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibgd-perlsourcesid2.84-3not yet assignedNot reportedNot reported
Debianlibgd-perlsourceforky2.84-3not yet assignedNot reportedNot reported
Debianlibgd-perlsourcetrixie2.78-1+deb13u1not yet assignedNot reportedNot reported
Debianlibgd-perlsourcebookworm2.76-4+deb12u1not yet assignedNot reportedNot reported
Cpelibgd-perlcpeNot reported2.78-1ubuntu0.24.04.1Not reportedNot reportedNot reported
Alpineperl-gdapk3.212.86-r0Not reportedALPINE-CVE-2026-11526Not reported
Alpineperl-gdapk3.222.86-r0Not reportedALPINE-CVE-2026-11526Not reported
Alpineperl-gdapk3.232.86-r0Not reportedALPINE-CVE-2026-11526Not reported
Alpineperl-gdapk3.242.86-r0Not reportedALPINE-CVE-2026-11526Not reported
Ubuntulibgd-perldeb22.042.76-2ubuntu0.1Not reportedUSN-8484-1Not reported
Ubuntulibgd-perldeb24.042.78-1ubuntu0.24.04.1Not reportedUSN-8484-1Not reported
Ubuntulibgd-perldeb25.102.78-1ubuntu0.25.10.1Not reportedUSN-8484-1Not reported
Ubuntulibgd-perldeb26.042.84-2ubuntu0.1Not reportedUSN-8484-1Not reported
Ubuntulibgd-perldeb22.042.76-2ubuntu0.1Not reportedUBUNTU-CVE-2026-11526Not reported
Ubuntulibgd-perldeb24.042.78-1ubuntu0.24.04.1Not reportedUBUNTU-CVE-2026-11526Not reported
Ubuntulibgd-perldeb25.102.78-1ubuntu0.25.10.1Not reportedUBUNTU-CVE-2026-11526Not reported
Ubuntulibgd-perldeb26.042.84-2ubuntu0.1Not reportedUBUNTU-CVE-2026-11526Not reported
Opensuseperl-GDrpmtumbleweed2.860.0-1.1Not reportedOPENSUSE-SU-2026:11017-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libgd-perl]Fixed
    Details (4)

    • 2.76-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.76-4+deb12u1

      nvd · libgd-perl · debian · bookworm; nvd · libgd-perl · debian · 12

    • 2.76-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.76-4+deb12u1

      nvd · libgd-perl · debian · bookworm; nvd · libgd-perl · debian · 12

    • 2.76-4+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.76-4+deb12u1

      nvd · libgd-perl · debian · bookworm; nvd · libgd-perl · debian · 12

    • 2.76-4+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.76-4+deb12u1

      nvd · libgd-perl · debian · bookworm; nvd · libgd-perl · debian · 12

[Debian 13 (Trixie)]

  • [libgd-perl]Fixed
    Details (4)

    • 2.78-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.78-1+deb13u1

      nvd · libgd-perl · debian · 13

    • 2.78-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.78-1+deb13u1

      nvd · libgd-perl · debian · 13

    • 2.78-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.78-1+deb13u1

      nvd · libgd-perl · debian · 13

    • 2.78-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.78-1+deb13u1

      nvd · libgd-perl · debian · 13

[openSUSE Tumbleweed]

  • [perl-GD]Fixed

    Source package: [perl-GD]

    Details (1)

    • 2.860.0-2.4 · x86_64 · tumbleweed

      Fixed · Fixed: 2.860.0-1.1

      nvd · perl-GD · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]