PT-2026-41439 · Canonical+1 · Babl+1

Carter Yagemann · CVE-2020-37239 · Published 2026-05-16 · Updated 2026-05-16

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libbabl version 0.1.62

Description An issue exists where double free detection is broken, allowing attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. By calling the babl free() function twice on the same pointer, detection is not triggered because libc's malloc metadata overwrites the signature field of babl upon freeing. This can lead to memory corruption and potential code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2020-37239

Affected Products

Babl

Libbabl

References · 8

• 🔥 https://exploit-db.com/exploits/49259 · Exploit
• https://cve.org/CVERecord?id=CVE-2020-37239 · Security Note
• https://ubuntu.com/security/CVE-2020-37239 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-37239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-37239 · Security Note
• https://vulncheck.com/advisories/libbabl-broken-double-free-detection-memory-safety · Note
• https://gegl.org · Note
• https://gegl.org/babl · Note