CVE-2020-37239 libbabl 0.1.62 Broken Double Free Detection Memory Safety
Attackers can bypass double-free detection in libbabl to achieve memory corruption and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-37239?
CVE-2020-37239 is a critical memory corruption vulnerability in Gegl libbabl, published on 16 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature field upon freeing, enabling potential memory corruption and code execution.
Weakness: CWE-415
Which versions are affected by CVE-2020-37239?
How do I fix CVE-2020-37239?
No fix has been published for CVE-2020-37239 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-37239 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37239 exists.
Sources
Also known as GHSA-4fvf-cvgm-9hvc, UBUNTU-CVE-2020-37239.