CVE-2019-11932Android-Gif-Drawable Vulnerability
android-gif-drawable Double Free vulnerability
Published May 24, 2022 · Updated Jul 8, 2026 · Also known as GHSA-x534-j49x-mqvj
Key Facts
Patch immediately- CVE-2019-11932 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Android-Gif-Drawable (Android-Gif-Drawable Project), Whatsapp, pl.droidsonroids.gif:android-gif-drawable (maven).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 45% probability of exploitation in the next 30 days.
- Fixed versions are available, including Android-Gif-Drawable 1.2.18, pl.droidsonroids.gif:android-gif-drawable 1.2.18, Whatsapp 2.19.244.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
45%
Higher than 98.7% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
45/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2019-11932
- advisoryhttps://www.facebook.com/security/advisories/cve-2019-11932
- advisoryhttp://packetstormsecurity.com/files/154867/Whatsapp-2.19.216-Remote-Code-Execution.html
- advisoryhttp://packetstormsecurity.com/files/158306/WhatsApp-android-gif-drawable-Double-Free.html
- advisory20191126 CVE-2019-11932 (double free in libpl_droidsonroids_gif) many apps vulnerable
- advisoryhttps://gist.github.com/wdormann/874198c1bd29c7dd2157d9fc1d858263
Description
A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Android-Gif-DrawableAndroid-Gif-Drawable Project | >= unspecified | 1.2.18 |
| WhatsappWhatsapp | See advisory | 2.19.244 |
| pl.droidsonroids.gif:android-gif-drawablemaven | See advisory | 1.2.18 |
Patched Releases
Android-Gif-Drawable
1.2.18
pl.droidsonroids.gif:android-gif-drawable
1.2.18
2.19.244
Timeline
Publicly disclosed
May 24, 2022
Last updated
Jul 8, 2026
Weakness Type
- CWE-415 Double Free
References
- advisorynvd.nist.gov · CVE-2019-11932
- advisoryfacebook.com · CVE-2019-11932
- advisorypacketstormsecurity.com · Whatsapp-2.19.216-Remote-Code-Execution.html
- advisorypacketstormsecurity.com · WhatsApp-android-gif-drawable-Double-Free.html
- advisory20191126 CVE-2019-11932 (double free in libpl_droidsonroids_gif) many apps vulnerable
FAQ
Common Questions.
A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is…
Affected: Android-Gif-Drawable (Android-Gif-Drawable Project) versions >= unspecified; Whatsapp; pl.droidsonroids.gif:android-gif-drawable (maven). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Android-Gif-Drawable 1.2.18, pl.droidsonroids.gif:android-gif-drawable 1.2.18, Whatsapp 2.19.244.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2019-11932 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo