A double free protection mechanism in libbabl 0.1.62 is ineffective because the library’s internal signature field is overwritten by the underlying malloc implementation when a chunk is freed. This allows an attacker to call babl_free() twice on the same pointer without triggering the library’s detection logic. As described, the flaw can lead to arbitrary memory corruption and the advisory notes the possibility of code execution. The impact is a loss of process integrity and, potentially, confidentiality if sensitive data is accessed during corruption. No explicit confirmation of privilege escalation is provided in the advisory, so that remains an open question.

The vulnerability affects only the Gegl libbabl component at version 0.1.62. Any application or system linking against this specific library release is vulnerable; other versions or vendors are not listed as affected.

The CVSS score of 9.3 indicates critical severity. The EPSS score is not available, so the current exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog. The description does not explicitly state an attack vector; however, based on the description, it is inferred that an attacker would need to trigger two consecutive free operations on the same pointer, which typically requires influence over libbabl's memory allocation flow. Successful exploitation would allow memory corruption and potentially arbitrary code execution within the process.