CVE-2026-26740

HIGH

8.2

CVSS Score

Published: March 18, 2026 at 12:00 AM UTC

Updated: July 23, 2026 at 07:31 PM UTC

2 products affected across 2 vendorsGiflibEnterprise Linux

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.2

Exploit prediction

EPSS 0.6%

SSVC

PoC

Description

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Giflib · Giflib Project

95%

5.2.2

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 0:5.1.4-3.el8_4.2 (unaffected)

Vendor states this is fixed in 0:5.1.4-3.el8_6.2 (unaffected)

Vendor states this is fixed in 0:5.1.4-3.el8_8.2 (unaffected)

Vendor states this is fixed in 0:5.1.4-5.el8_10 (unaffected)

Vendor states this is fixed in 0:5.2.1-10.el9_8.2 (unaffected)

Vendor states this is fixed in 0:5.2.1-22.el10_0.2 (unaffected)

Vendor states this is fixed in 0:5.2.1-25.el10_2 (unaffected)

Vendor states this is fixed in 0:5.2.1-9.el9_2.2 (unaffected)

Vendor states this is fixed in 0:5.2.1-9.el9_4.2 (unaffected)

Vendor states this is fixed in 0:5.2.1-9.el9_6.2 (unaffected)

Vendor states this is fixed in 1:1.8.0.492.b09-1.el8 (unaffected)

Vendor states this is fixed in 1:1.8.0.492.b09-1.el9 (unaffected)

Vendor states this is fixed in 1:1.8.0.492.b09-2.el9 (unaffected)

Vendor states this is fixed in 1:17.0.19.0.10-1.el8 (unaffected)

Vendor states this is fixed in 1:17.0.19.0.10-1.el9 (unaffected)

Vendor states this is fixed in 1:17.0.19.0.10-2.el9 (unaffected)

Vendor states this is fixed in 1:21.0.11.0.10-1.el10_2 (unaffected)

Vendor states this is fixed in 1:21.0.11.0.10-1.el8 (unaffected)

Vendor states this is fixed in 1:21.0.11.0.10-1.el9 (unaffected)

Vendor states this is fixed in 1:21.0.11.0.10-2.el10_2 (unaffected)

Vendor states this is fixed in 1:21.0.11.0.10-2.el9 (unaffected)

Vendor states this is fixed in 1:25.0.3.0.9-1.el10_2 (unaffected)

Vendor states this is fixed in 1:25.0.3.0.9-1.el9 (unaffected)

Vendor states this is fixed in 7 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.