Log in Start free

Vulnerability · Published Mar 10, 2026 · Assigned by Meta

CVE-2026-23868

Medium 5.1

In plain English

A medium-severity double free in giflib from giflib. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.1Medium
Exploit odds (30 days)0.2%top 93.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10giflib5.2.1-22.el10_1.1ALSA-2026:8858
AlmaLinux:10giflib5.2.1-24.el10_2ALSA-2026:19154
AlmaLinux:8giflib5.1.4-4.el8_10ALSA-2026:8861
AlmaLinux:9giflib5.2.1-10.el9_8.1ALSA-2026:19367
AlmaLinux:9giflib5.2.1-9.el9_7.1ALSA-2026:8859
AlmaLinux:10giflib-devel5.2.1-24.el10_2ALSA-2026:19154
AlmaLinux:10giflib-devel5.2.1-22.el10_1.1ALSA-2026:8858
AlmaLinux:8giflib-devel5.1.4-4.el8_10ALSA-2026:8861
AlmaLinux:9giflib-devel5.2.1-10.el9_8.1ALSA-2026:19367
AlmaLinux:9giflib-devel5.2.1-9.el9_7.1ALSA-2026:8859
Debian:12giflib5.2.1-2.5+deb12u1DEBIAN-CVE-2026-23868
Debian:13giflib5.2.2-1+deb13u1DEBIAN-CVE-2026-23868
Debian:14giflib6.1.3-1DEBIAN-CVE-2026-23868
Rocky Linux:10giflib0:5.2.1-24.el10_2RLSA-2026:19154
Rocky Linux:10giflib0:5.2.1-22.el10_1.1RLSA-2026:8858
Rocky Linux:8giflib0:5.1.4-4.el8_10RLSA-2026:8861
Rocky Linux:9giflib0:5.2.1-9.el9_7.1RLSA-2026:8859
Rocky Linux:9giflib0:5.2.1-10.el9_8.1RLSA-2026:19367
Ubuntu:22.04:LTSgiflib5.1.9-2ubuntu0.3UBUNTU-CVE-2026-23868
Ubuntu:22.04:LTSgiflib5.1.9-2ubuntu0.3USN-8583-1
Ubuntu:24.04:LTSgiflib5.2.2-1ubuntu1.2UBUNTU-CVE-2026-23868
Ubuntu:24.04:LTSgiflib5.2.2-1ubuntu1.2USN-8583-1
Ubuntu:25.10giflibno fix listedUBUNTU-CVE-2026-23868
Ubuntu:26.04:LTSgiflib5.2.2-1ubuntu3.2UBUNTU-CVE-2026-23868
Ubuntu:26.04:LTSgiflib5.2.2-1ubuntu3.2USN-8583-1

Affected products (as reported)

VendorProductVersions
giflib giflib 5.0.0 – through 6.1.1

Weakness: CWE-415, CWE-825 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References