CVE-2018-3838

An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability.

• CWE-125

• https://security.gentoo.org/glsa/201903-17Third Party Advisory
• https://www.debian.org/security/2018/dsa-4177Third Party Advisory
• https://www.debian.org/security/2018/dsa-4184Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0520Exploit, Technical Description, Third Party Advisory
• https://security.gentoo.org/glsa/201903-17Third Party Advisory
• https://www.debian.org/security/2018/dsa-4177Third Party Advisory
• https://www.debian.org/security/2018/dsa-4184Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0520Exploit, Technical Description, Third Party Advisory

Published

Apr 10, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-3832An exploitable firmware update vulnerability exists in Inste…9
• CVE-2018-3833An exploitable firmware downgrade vulnerability exists in In…7.5
• CVE-2018-3834An exploitable permanent denial of service vulnerability exi…7.4
• CVE-2018-3835An exploitable out of bounds write vulnerability exists in v…8.8
• CVE-2018-3836An exploitable command injection vulnerability exists in the…7.8
• CVE-2018-3837An exploitable information disclosure vulnerability exists i…5.5
• CVE-2018-3839An exploitable code execution vulnerability exists in the XC…8.8
• CVE-2018-3840A denial-of-service vulnerability exists in the Pixar Render…7.5
• CVE-2018-3841A denial-of-service vulnerability exists in the Pixar Render…7.5
• CVE-2018-3842An exploitable use of an uninitialized pointer vulnerability…8.8
• CVE-2018-3843An exploitable type confusion vulnerability exists in the wa…8.8
• CVE-2018-3844In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 …8.8