Giflib is a widely embedded image-processing library for parsing and manipulating GIF files, and despite its focused product scope, maintains prominence across a diverse range of applications and systems that handle image data. Its vulnerability profile concentrates on memory-safety weaknesses endemic to C-based parsing: out-of-bounds writes, double-free conditions, improper buffer-bounds validation, and classic buffer overflows that arise from the need to unpack variable-length image structures. Defenders should inventory applications and tools that link this library, as individual flaws can propagate across all downstream consumers; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Giflib Project over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-3177CRITICAL Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors. | Jan 23, 2017 | 9.8 | 30 | NO | NO |
CVE-2026-26740HIGH Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension b | Mar 18, 2026 | 8.2 | 29 | NO | NO |
CVE-2026-23868HIGH Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerabil | Mar 10, 2026 | 7.0 | 27 | NO | NO |
CVE-2021-40633HIGH A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file. | Jun 14, 2022 | 8.8 | 27 | NO | NO |
CVE-2018-11490HIGH The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Pr | May 26, 2018 | 8.8 | 27 | NO | NO |
CVE-2018-11489HIGH The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain Crn | May 26, 2018 | 8.8 | 27 | NO | NO |
CVE-2020-23922HIGH An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read. | Apr 21, 2021 | 7.1 | 24 | NO | NO |
CVE-2024-45993MEDIUM Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. | Sep 30, 2024 | 6.5 | 22 | NO | NO |
CVE-2023-48161HIGH Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c | Nov 22, 2023 | 7.1 | 22 | NO | NO |
CVE-2019-15133MEDIUM In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data stru | Aug 17, 2019 | 6.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Giflib Project.
Media articles that mention a CVE ID that affects a product developed by Giflib Project — matched by CVE ID, not by vendor name.