High severity8.2NVD Advisory· Published Mar 18, 2026· Updated Jul 23, 2026
CVE-2026-26740
CVE-2026-26740
Description
Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size.
Affected products
33cpe:2.3:a:giflib_project:giflib:5.2.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:giflib_project:giflib:5.2.2:*:*:*:*:*:*:*
- (no CPE)range: <5.2.2
- giflib/giflibdescription
- osv-coords30 versionspkg:rpm/almalinux/giflibpkg:rpm/almalinux/giflib-develpkg:rpm/almalinux/java-25-openjdkpkg:rpm/almalinux/java-25-openjdk-crypto-adapterpkg:rpm/almalinux/java-25-openjdk-crypto-adapter-fastdebugpkg:rpm/almalinux/java-25-openjdk-crypto-adapter-slowdebugpkg:rpm/almalinux/java-25-openjdk-demopkg:rpm/almalinux/java-25-openjdk-demo-fastdebugpkg:rpm/almalinux/java-25-openjdk-demo-slowdebugpkg:rpm/almalinux/java-25-openjdk-develpkg:rpm/almalinux/java-25-openjdk-devel-fastdebugpkg:rpm/almalinux/java-25-openjdk-devel-slowdebugpkg:rpm/almalinux/java-25-openjdk-fastdebugpkg:rpm/almalinux/java-25-openjdk-headlesspkg:rpm/almalinux/java-25-openjdk-headless-fastdebugpkg:rpm/almalinux/java-25-openjdk-headless-slowdebugpkg:rpm/almalinux/java-25-openjdk-javadocpkg:rpm/almalinux/java-25-openjdk-javadoc-zippkg:rpm/almalinux/java-25-openjdk-jmodspkg:rpm/almalinux/java-25-openjdk-jmods-fastdebugpkg:rpm/almalinux/java-25-openjdk-jmods-slowdebugpkg:rpm/almalinux/java-25-openjdk-slowdebugpkg:rpm/almalinux/java-25-openjdk-srcpkg:rpm/almalinux/java-25-openjdk-src-fastdebugpkg:rpm/almalinux/java-25-openjdk-src-slowdebugpkg:rpm/almalinux/java-25-openjdk-static-libspkg:rpm/almalinux/java-25-openjdk-static-libs-fastdebugpkg:rpm/almalinux/java-25-openjdk-static-libs-slowdebugpkg:rpm/opensuse/giflib&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/giflib&distro=openSUSE%20Tumbleweed
< 5.2.1-10.el9_8.2+ 29 more
- (no CPE)range: < 5.2.1-10.el9_8.2
- (no CPE)range: < 5.2.1-10.el9_8.2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 1:25.0.3.0.9-1.el10_2
- (no CPE)range: < 5.2.2-160000.4.1
- (no CPE)range: < 5.2.2-4.1
Patches
Vulnerability mechanics
References
21- github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_len_heap_oobwrite_disclosure.mdnvdExploitThird Party Advisory
- access.redhat.com/errata/RHSA-2026:33447nvd
- access.redhat.com/errata/RHSA-2026:33450nvd
- access.redhat.com/errata/RHSA-2026:33451nvd
- access.redhat.com/errata/RHSA-2026:33452nvd
- access.redhat.com/errata/RHSA-2026:33455nvd
- access.redhat.com/errata/RHSA-2026:33456nvd
- access.redhat.com/errata/RHSA-2026:33501nvd
- access.redhat.com/errata/RHSA-2026:33502nvd
- access.redhat.com/errata/RHSA-2026:33503nvd
- access.redhat.com/errata/RHSA-2026:33509nvd
- access.redhat.com/errata/RHSA-2026:36004nvd
- access.redhat.com/errata/RHSA-2026:36005nvd
- access.redhat.com/errata/RHSA-2026:36006nvd
- access.redhat.com/errata/RHSA-2026:9683nvd
- access.redhat.com/errata/RHSA-2026:9686nvd
- access.redhat.com/errata/RHSA-2026:9689nvd
- access.redhat.com/errata/RHSA-2026:9693nvd
- access.redhat.com/security/cve/CVE-2026-26740nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26740.jsonnvd
News mentions
0No linked articles in our index yet.