CVE-2026-23868

Name
CVE-2026-23868
Description
Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve-assign@fb.com https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106/tree/gifalloc.c?diff=5146815377b7395944cb683a08c43eee3f631eb7
cve-assign@fb.com https://www.facebook.com/security/advisories/cve-2026-23868
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:16008
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:16009
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:16030
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:16174
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:19154
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:19367
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:19724
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:19725
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25096
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:8858
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:8859
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:8861
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:8883
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:8884
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:8885
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:8886
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:8887
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:9290
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:9291
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:9292
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:9294
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:9295
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/security/cve/CVE-2026-23868
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://bugzilla.redhat.com/show_bug.cgi?id=2446207
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23868.json

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:giflib_project:giflib:*:*:*:*:*:*:*:* giflib >= 5.0.0 <= 6.1.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
giflib edge-main 5.2.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib edge-main 5.2.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib edge-main 5.2.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib edge-main 5.2.1-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib edge-main 5.2.1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib edge-main 5.2.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib edge-main 5.2.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.24-main 5.2.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.24-main 5.2.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.23-main 5.2.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.23-main 5.2.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.22-main 5.2.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.22-main 5.2.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.22-main 5.2.2-r0 None possibly vulnerable
giflib 3.22-main 5.2.1-r2 None possibly vulnerable
giflib 3.21-main 5.2.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.21-main 5.2.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.21-main 5.2.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.21-main 5.2.1-r2 None possibly vulnerable
giflib 3.20-main 5.2.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.20-main 5.2.1-r2 None possibly vulnerable
giflib 3.19-main 5.2.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.19-main 5.2.1-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.19-main 5.2.1-r2 None possibly vulnerable