{"action":"Upgrade feh to 2.18-2 or later.","affected":[{"fixed":"2.18-2","introduced":"0"}],"component":"feh","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["2.18-2"],"id":"tcs_01M5NCNP3E8N10GATV3BH6JRZ7","modified_at":"2026-09-01T20:03:50.739651734Z","published_at":"2017-04-14T18:59:01.173Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2017-7875","https://security-tracker.debian.org/tracker/CVE-2017-7875"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2017-7875#Debian:14/feh","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2017-7875"}],"summary":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer ov"}