CVE-2020-37239

libbabl 0.1.62 Broken Double Free Detection Memory Safety

CVSS 9.3 CRITICALEPSS 0.5%CWE-415

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.3EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

16 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature field upon freeing, enabling potential memory corruption and code execution.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Gegl · libbabl

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/49259unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.exploit-db.com/exploits/49259 https://www.gegl.org https://www.gegl.org/babl/https://www.vulncheck.com/advisories/libbabl-broken-double-free-detection-memory-safety