Is CVE-2026-23868 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23868 being exploited in the wild.

How severe is CVE-2026-23868?

Medium severity, with a CVSS score of 5.1, published 10 March 2026.

Which products and versions are affected?

Giflib Project Giflib 5.0.0 through 6.1.1; Red Hat AI Inference Server 3.3.3.

Is there a fix for CVE-2026-23868?

A patch was published on 2026-03-10: Patch committed to giflib SourceForge repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23868 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-23868?

Check whether you run Giflib Project Giflib or Red Hat AI Inference Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23868: Giflib double free in GifMakeSavedImage

CVE-2026-23868 · Severity: medium · CVSS 5.1 · Published 2026-03-10

Giflib, a widely used library for processing GIF images, contains a flaw in how it handles memory during image processing. An attacker could potentially exploit this to cause a system crash or service disruption by providing a specially crafted image file. While the conditions to trigger this are difficult to meet, it affects various systems that rely on this library for image rendering, including several Red Hat Enterprise Linux versions.

Technologies: Red Hat AI Inference Server. Vendors: Red Hat.

Quick answers

Is CVE-2026-23868 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23868 being exploited in the wild.
How severe is CVE-2026-23868?: Medium severity, with a CVSS score of 5.1, published 10 March 2026.
Which products and versions are affected?: Giflib Project Giflib 5.0.0 through 6.1.1; Red Hat AI Inference Server 3.3.3.
Is there a fix for CVE-2026-23868?: A patch was published on 2026-03-10: Patch committed to giflib SourceForge repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23868 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-23868?: Check whether you run Giflib Project Giflib or Red Hat AI Inference Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A double-free vulnerability exists in Giflib within the `GifMakeSavedImage` function in `gifalloc.c`. The root cause is a shallow copy of image data combined with incorrect error handling; if an allocation fails partway through the process, the library may attempt to free the same memory address twice. Specifically, the function fails to null out aliased pointers (`ColorMap`, `RasterBits`, `ExtensionBlocks`) before subsequent allocations, leading `FreeLastSavedImage` to release already-freed data from the source object. Exploitation typically requires a local attack vector with high complexity, potentially leading to a denial-of-service (DoS). Patches have been identified in the SourceForge repository that null out these pointers before new allocations occur.

Affected products

giflib giflib 5.0.0 through 6.1.1
Red Hat Enterprise Linux 7, 8, 10
Red Hat AI Inference Server 3.3.3

Timeline

2026-03-10: advisory: Initial advisory published by Facebook and NVD
2026-03-10: patched: Patch committed to giflib SourceForge repository
2026-05-11: advisory: Red Hat published multiple security advisories (RHSA) for affected products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.