CVE-2016-9011

The wmf_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure.

• CWE-119

• http://www.openwall.com/lists/oss-security/2016/10/25/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/93860Third Party Advisory, VDB Entry
• https://blogs.gentoo.org/ago/2016/10/18/libwmf-memory-allocation-failure-in-wmf_malloc-api-cThird Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1388450Issue Tracking
• http://www.openwall.com/lists/oss-security/2016/10/25/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/93860Third Party Advisory, VDB Entry
• https://blogs.gentoo.org/ago/2016/10/18/libwmf-memory-allocation-failure-in-wmf_malloc-api-cThird Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1388450Issue Tracking

Published

Mar 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9000IBM InfoSphere DataStage is vulnerable to cross-frame script…
• CVE-2016-9005IBM System Storage TS3100-TS3200 Tape Library could allow an…
• CVE-2016-9006IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site…
• CVE-2016-9008IBM UrbanCode Deploy could allow a malicious user to access …
• CVE-2016-9009IBM WebSphere MQ 8.0 could allow an authenticated user with …
• CVE-2016-9010IBM WebSphere Message Broker 9.0 and 10.0 could allow a remo…
• CVE-2016-9012CloudVision Portal (CVP) before 2016.1.2.1 allows remote aut…
• CVE-2016-9013Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x …
• CVE-2016-9014Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and …
• CVE-2016-9015Versions 1.17 and 1.18 of the Python urllib3 library suffer …
• CVE-2016-9016Firejail 0.9.38.4 allows local users to execute arbitrary co…
• CVE-2016-9017Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d2…