CVE-2026-23868
Published: March 10th, 2026
Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.
MEDIUM
CVSS v3: 5.1
CVSS v3: 5.1
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 0.0.0.1 | giflib (5.2.1) | Not Affected | Code Not Reachable | GifMakeSavedImage is never called by Document Filters. The GIF decoder uses DGifOpen/DGifSlurp/DGifCloseFile which internally manage SavedImages via reallocarray without calling GifMakeSavedImage. The encoder uses a custom GifMakePalette. The upstream patch has NOT been applied as it introduces a memory leak bug (ExtensionBlockCount zeroed but never restored) and the vulnerable function is unreachable. |
| 26.1.1 | giflib (5.2.1) | Needs Triage | ||
| 26.1 | giflib (5.2.1) | Needs Triage | ||
| 25.4 | giflib (5.2.1) | Needs Triage | ||
| 25.3 | giflib (5.2.1) | Needs Triage | ||
| 25.2 | giflib (5.2.1) | Needs Triage | ||
| 25.1.2 | giflib (5.2.1) | Not Affected | Code Not Reachable | GifMakeSavedImage is never called by Document Filters. The GIF decoder uses DGifOpen/DGifSlurp/DGifCloseFile which internally manage SavedImages via reallocarray without calling GifMakeSavedImage. The encoder uses a custom GifMakePalette. The upstream patch has NOT been applied as it introduces a memory leak bug (ExtensionBlockCount zeroed but never restored) and the vulnerable function is unreachable. |
| 25.1.1 | giflib (5.2.1) | Needs Triage | ||
| 25.1 | giflib (5.2.1) | Needs Triage | ||
| 24.4 | giflib (5.2.1) | Needs Triage | ||
| 24.4.0 | giflib (5.2.1) | Needs Triage | ||
| 24.3 | giflib (5.2.1) | Needs Triage | ||
| 24.2.1 | giflib (5.2.1) | Needs Triage | ||
| 24.2 | giflib (5.2.1) | Needs Triage | ||
| 24.1 | giflib (5.2.1) | Needs Triage | ||
| 23.3 | giflib (5.2.1) | Needs Triage | ||
| 23.2.1 | giflib (5.2.1) | Needs Triage | ||
| 23.2 | giflib (5.2.1) | Needs Triage | ||
| 23.1 | giflib (5.2.1) | Needs Triage | ||
| 22.4 | giflib (5.2.1) | Needs Triage | ||
| 22.3 | giflib (5.2.1) | Needs Triage | ||
| 22.2 | giflib (5.2.1) | Needs Triage | ||
| 22.1 | giflib (5.2.1) | Needs Triage | ||
| 21.11.1 | giflib (5.2.1) | Needs Triage | ||
| 21.11 | giflib (5.2.1) | Needs Triage | ||
| 21.8.1 | giflib (5.2.1) | Needs Triage | ||
| 21.8 | giflib (5.2.1) | Needs Triage | ||
| 21.5.1 | giflib (5.2.1) | Needs Triage | ||
| 21.5.0 | giflib (5.2.1) | Needs Triage | ||
| 21.2.0 | giflib (5.2.1) | Needs Triage | ||
| 11.4.20 | giflib (5.2.1) | Needs Triage | ||
| 11.4.19.3667 | giflib (5.2.1) | Needs Triage | ||
| 11.4.18.3599 | giflib (5.2.1) | Needs Triage | ||
| 11.4.17 | giflib (5.2.1) | Needs Triage | ||
| 11.4.16.3445 | giflib (5.2.1) | Needs Triage | ||
| 11.4.15.3368 | giflib (5.2.1) | Needs Triage | ||
| 11.4.14.3263 | giflib (5.1.4) | Needs Triage | ||
| 11.4.13.3179 | giflib (5.1.4) | Needs Triage | ||
| 11.4.12.3054 | giflib (5.1.4) | Needs Triage | ||
| 11.4.11.3040 | giflib (5.1.4) | Needs Triage | ||
| 11.4.11.2990 | giflib (5.1.4) | Needs Triage | ||
| 11.4.10.2934 | giflib (5.1.4) | Needs Triage | ||
| 11.4.9.2878 | giflib (5.1.4) | Needs Triage | ||
| 11.4.8.2822 | giflib (5.1.4) | Needs Triage |
Severity score breakdown
Attack Complexity
HIGH
Attack Vector
LOCAL
Availability Impact
HIGH
Base Score
5.1
Base Severity
MEDIUM
Confidentiality Impact
NONE
Integrity Impact
NONE
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Version
3.1