Catalogue CVE

CVE-2026-23868

Giflib contains a double-free vulnerability that is…

[Catalogue CVE]

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.

Gravité
High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiegiflib5.2.2-1+deb13u1FixedDistribution-reported fixed boundary[CVE-2026-23868]
Debiansidgiflib6.1.3-1FixedDistribution-reported fixed boundary[CVE-2026-23868]
Debianforkygiflib6.1.3-1FixedDistribution-reported fixed boundary[CVE-2026-23868]
Debianbookwormgiflib5.2.1-2.5+deb12u1FixedDistribution-reported fixed boundary[CVE-2026-23868]

Showing 4 fix observations. All 31 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedgiflib5.2.1-2.5+deb12u1UnknownSource applicability is not establishedProvider not reported
Debianbookwormgiflib5.2.1-2.5+deb12u1FixedDistribution-reported fixed boundary[CVE-2026-23868]
Debianforkygiflib6.1.3-1FixedDistribution-reported fixed boundary[CVE-2026-23868]
Debiansidgiflib6.1.3-1FixedDistribution-reported fixed boundary[CVE-2026-23868]
Debiantrixiegiflib5.2.2-1+deb13u1FixedDistribution-reported fixed boundary[CVE-2026-23868]
Opensuseleap 15.6giflib5.2.2-150000.4.19.1UnknownSource applicability is not established[SUSE-SU-2026:1338-1]
Opensuseleap 16.0giflib5.2.2-160000.3.1UnknownSource applicability is not established[OPENSUSE-SU-2026:20601-1]
Opensusetumbleweedgiflib5.2.2-3.1UnknownSource applicability is not established[OPENSUSE-SU-2026:10326-1]
Suselinux enterprise module for basesystem 15 sp7giflib5.2.2-150000.4.19.1UnknownSource applicability is not established[SUSE-SU-2026:1338-1]
Ubuntu20.04giflib5.1.4-3ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2026-23868]
Ubuntu20.04giflib5.1.9-1UnknownSource applicability is not established[UBUNTU-CVE-2026-23868]
Ubuntu20.04giflib5.1.9-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2026-23868]
Ubuntu22.04giflib5.1.9-2build1UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu22.04giflib5.1.9-2build2UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu22.04giflib5.1.9-2ubuntu0.1UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu22.04giflib5.1.9-2ubuntu0.3UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu24.04giflib5.2.1-2.5UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu24.04giflib5.2.2-1ubuntu1UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu24.04giflib5.2.2-1ubuntu1.2UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu25.10giflib5.2.2-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2026-23868]
Ubuntu26.04giflib5.2.2-1ubuntu2UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu26.04giflib5.2.2-1ubuntu3UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntu26.04giflib5.2.2-1ubuntu3.2UnknownSource applicability is not established[USN-8583-1][UBUNTU-CVE-2026-23868]
Ubuntunoblegiflib5.2.2-1ubuntu1.2UnknownSource applicability is not establishedProvider not reported
Ubuntunoblegiflib-tools5.2.2-1ubuntu1.2UnknownSource applicability is not establishedProvider not reported
Ubuntunoblelibgif-dev5.2.2-1ubuntu1.2UnknownSource applicability is not establishedProvider not reported
Ubuntunoblelibgif75.2.2-1ubuntu1.2UnknownSource applicability is not establishedProvider not reported
Ubuntuprogiflib5.1.4-1UnknownSource applicability is not established[UBUNTU-CVE-2026-23868]
Ubuntuprogiflib5.1.4-2UnknownSource applicability is not established[UBUNTU-CVE-2026-23868]
Ubuntuprogiflib5.1.4-2ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2026-23868]
Ubuntuprogiflib5.1.4-2ubuntu0.1+esm1UnknownSource applicability is not established[UBUNTU-CVE-2026-23868]
Original provider fields
{
  "package_releases": [
    {
      "name": "giflib",
      "status": "fixed",
      "release": "sid",
      "version": "6.1.3-1"
    },
    {
      "name": "giflib",
      "status": "fixed",
      "release": "forky",
      "version": "6.1.3-1"
    },
    {
      "name": "giflib",
      "status": "fixed",
      "release": "trixie",
      "version": "5.2.2-1+deb13u1"
    },
    {
      "name": "giflib",
      "status": "fixed",
      "release": "bookworm",
      "version": "5.2.1-2.5+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1130495,
      "name": "giflib",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "6.1.3-1"
    },
    {
      "bug": 1130495,
      "name": "giflib",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "6.1.3-1"
    },
    {
      "bug": 1130495,
      "name": "giflib",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.2.2-1+deb13u1"
    },
    {
      "bug": 1130495,
      "name": "giflib",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "5.2.1-2.5+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "giflib",
      "fixed_version": "5.2.1-2.5+deb12u1",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "5.2.2-1ubuntu1.2",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "5.2.2-1ubuntu1.2",
      "applicability_unknown": true
    },
    {
      "name": "giflib-tools",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "5.2.2-1ubuntu1.2",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "5.2.2-1ubuntu1.2",
      "applicability_unknown": true
    },
    {
      "name": "libgif-dev",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "5.2.2-1ubuntu1.2",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "5.2.2-1ubuntu1.2",
      "applicability_unknown": true
    },
    {
      "name": "libgif7",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "5.2.2-1ubuntu1.2",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "5.2.2-1ubuntu1.2",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.9-2ubuntu0.3"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "5.1.9-2build1",
        "5.1.9-2build2",
        "5.1.9-2ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8583-1",
      "fixed_version": "5.1.9-2ubuntu0.3",
      "provider_source": "pypi",
      "provider_record_id": "USN-8583-1",
      "provider_updated_at": "2026-07-22T20:59:38.396563207Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2-1ubuntu1.2"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "5.2.1-2.5",
        "5.2.2-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8583-1",
      "fixed_version": "5.2.2-1ubuntu1.2",
      "provider_source": "pypi",
      "provider_record_id": "USN-8583-1",
      "provider_updated_at": "2026-07-22T20:59:38.396563207Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2-1ubuntu3.2"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "5.2.2-1ubuntu2",
        "5.2.2-1ubuntu3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8583-1",
      "fixed_version": "5.2.2-1ubuntu3.2",
      "provider_source": "pypi",
      "provider_record_id": "USN-8583-1",
      "provider_updated_at": "2026-07-22T20:59:38.396563207Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "5.1.4-1",
        "5.1.4-2",
        "5.1.4-2ubuntu0.1",
        "5.1.4-2ubuntu0.1+esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-23868",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-23868",
      "provider_updated_at": "2026-07-22T20:45:27.753361305Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "5.1.4-3ubuntu1",
        "5.1.9-1",
        "5.1.9-1ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-23868",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-23868",
      "provider_updated_at": "2026-07-22T20:45:27.753361305Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.9-2ubuntu0.3"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "5.1.9-2build1",
        "5.1.9-2build2",
        "5.1.9-2ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-23868",
      "fixed_version": "5.1.9-2ubuntu0.3",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-23868",
      "provider_updated_at": "2026-07-22T20:45:27.753361305Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2-1ubuntu1.2"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "5.2.1-2.5",
        "5.2.2-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-23868",
      "fixed_version": "5.2.2-1ubuntu1.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-23868",
      "provider_updated_at": "2026-07-22T20:45:27.753361305Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "5.2.2-1ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-23868",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-23868",
      "provider_updated_at": "2026-07-22T20:45:27.753361305Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2-1ubuntu3.2"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "5.2.2-1ubuntu2",
        "5.2.2-1ubuntu3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-23868",
      "fixed_version": "5.2.2-1ubuntu3.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-23868",
      "provider_updated_at": "2026-07-22T20:45:27.753361305Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2-160000.3.1"
            }
          ]
        }
      ],
      "release": "leap 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:20601-1",
      "fixed_version": "5.2.2-160000.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:20601-1",
      "provider_updated_at": "2026-04-24T18:24:58.088441Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2-150000.4.19.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:1338-1",
      "fixed_version": "5.2.2-150000.4.19.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:1338-1",
      "provider_updated_at": "2026-04-16T08:30:51.261112Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2-150000.4.19.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:1338-1",
      "fixed_version": "5.2.2-150000.4.19.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:1338-1",
      "provider_updated_at": "2026-04-16T08:30:51.261112Z",
      "applicability_unknown": true
    },
    {
      "name": "giflib",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2-3.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:10326-1",
      "fixed_version": "5.2.2-3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:10326-1",
      "provider_updated_at": "2026-03-14T08:29:16.709735Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1130495]

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

  • [giflib-tools]Inconnu

    Paquet source: [giflib]

    Détails (2)
    • 5.2.1-2.5+deb12u1 · amd64 · bookworm

      Corrigée · Corrigée: 5.2.1-2.5+deb12u1

      nvd · giflib · debian · bookworm; nvd · giflib · debian · 12

    • 5.2.1-2.5+deb12u1 · arm64 · bookworm

      Corrigée · Corrigée: 5.2.1-2.5+deb12u1

      nvd · giflib · debian · bookworm; nvd · giflib · debian · 12

  • [libgif7]Inconnu

    Paquet source: [giflib]

    Détails (2)
    • 5.2.1-2.5+deb12u1 · amd64 · bookworm

      Corrigée · Corrigée: 5.2.1-2.5+deb12u1

      nvd · giflib · debian · bookworm; nvd · giflib · debian · 12

    • 5.2.1-2.5+deb12u1 · arm64 · bookworm

      Corrigée · Corrigée: 5.2.1-2.5+deb12u1

      nvd · giflib · debian · bookworm; nvd · giflib · debian · 12

  • [libgif-dev]Inconnu

    Paquet source: [giflib]

    Détails (2)
    • 5.2.1-2.5+deb12u1 · amd64 · bookworm

      Corrigée · Corrigée: 5.2.1-2.5+deb12u1

      nvd · giflib · debian · bookworm; nvd · giflib · debian · 12

    • 5.2.1-2.5+deb12u1 · arm64 · bookworm

      Corrigée · Corrigée: 5.2.1-2.5+deb12u1

      nvd · giflib · debian · bookworm; nvd · giflib · debian · 12

[Debian 13 (Trixie)]

  • [giflib-tools]Inconnu

    Paquet source: [giflib]

    Détails (2)
    • 5.2.2-1+deb13u1 · amd64 · trixie

      Corrigée · Corrigée: 5.2.2-1+deb13u1

      nvd · giflib · debian · 13

    • 5.2.2-1+deb13u1 · arm64 · trixie

      Corrigée · Corrigée: 5.2.2-1+deb13u1

      nvd · giflib · debian · 13

  • [libgif7]Inconnu

    Paquet source: [giflib]

    Détails (2)
    • 5.2.2-1+deb13u1 · amd64 · trixie

      Corrigée · Corrigée: 5.2.2-1+deb13u1

      nvd · giflib · debian · 13

    • 5.2.2-1+deb13u1 · arm64 · trixie

      Corrigée · Corrigée: 5.2.2-1+deb13u1

      nvd · giflib · debian · 13

  • [libgif-dev]Inconnu

    Paquet source: [giflib]

    Détails (2)
    • 5.2.2-1+deb13u1 · amd64 · trixie

      Corrigée · Corrigée: 5.2.2-1+deb13u1

      nvd · giflib · debian · 13

    • 5.2.2-1+deb13u1 · arm64 · trixie

      Corrigée · Corrigée: 5.2.2-1+deb13u1

      nvd · giflib · debian · 13

[openSUSE Tumbleweed]

  • [giflib-devel]Inconnu

    Paquet source: [giflib]

    Détails (1)
    • 5.2.2-4.3 · x86_64 · tumbleweed

      Inconnu · Corrigée: 5.2.2-3.1

      Version impact unknown

      nvd · giflib · opensuse · tumbleweed

  • Paquet source: [giflib]

    Détails (1)
    • 5.2.2-4.3 · x86_64 · tumbleweed

      Inconnu · Corrigée: 5.2.2-3.1

      Version impact unknown

      nvd · giflib · opensuse · tumbleweed

  • [giflib-progs]Inconnu

    Paquet source: [giflib]

    Détails (1)
    • 5.2.2-4.3 · x86_64 · tumbleweed

      Inconnu · Corrigée: 5.2.2-3.1

      Version impact unknown

      nvd · giflib · opensuse · tumbleweed

  • [libgif7]Inconnu

    Paquet source: [giflib]

    Détails (1)
    • 5.2.2-4.3 · x86_64 · tumbleweed

      Inconnu · Corrigée: 5.2.2-3.1

      Version impact unknown

      nvd · giflib · opensuse · tumbleweed

  • [libgif7-32bit]Inconnu

    Paquet source: [giflib]

    Détails (1)
    • 5.2.2-4.3 · x86_64 · tumbleweed

      Inconnu · Corrigée: 5.2.2-3.1

      Version impact unknown

      nvd · giflib · opensuse · tumbleweed

Observé:

Références