# CVE-2026-23868: Giflib double free in GifMakeSavedImage

Source: https://junglewise.ai/threats/cve-2026-23868-giflib-double-free-in-gifmakesavedimage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-23868 · Severity: medium · CVSS 5.1 · Published 2026-03-10

Giflib, a widely used library for processing GIF images, contains a flaw in how it handles memory during image processing. An attacker could potentially exploit this to cause a system crash or service disruption by providing a specially crafted image file. While the conditions to trigger this are difficult to meet, it affects various systems that rely on this library for image rendering, including several Red Hat Enterprise Linux versions.

Technologies: [Red Hat AI Inference Server](https://junglewise.ai/threats/technologies/ai-inference-server). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-23868 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23868 being exploited in the wild.

**How severe is CVE-2026-23868?** Medium severity, with a CVSS score of 5.1, published 10 March 2026.

**Which products and versions are affected?** Giflib Project Giflib 5.0.0 through 6.1.1; Red Hat AI Inference Server 3.3.3.

**Is there a fix for CVE-2026-23868?** A patch was published on 2026-03-10: Patch committed to giflib SourceForge repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23868 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-23868?** Check whether you run Giflib Project Giflib or Red Hat AI Inference Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A double-free vulnerability exists in Giflib within the `GifMakeSavedImage` function in `gifalloc.c`. The root cause is a shallow copy of image data combined with incorrect error handling; if an allocation fails partway through the process, the library may attempt to free the same memory address twice. Specifically, the function fails to null out aliased pointers (`ColorMap`, `RasterBits`, `ExtensionBlocks`) before subsequent allocations, leading `FreeLastSavedImage` to release already-freed data from the source object. Exploitation typically requires a local attack vector with high complexity, potentially leading to a denial-of-service (DoS). Patches have been identified in the SourceForge repository that null out these pointers before new allocations occur.

## Affected products

- giflib giflib 5.0.0 through 6.1.1
- Red Hat Enterprise Linux 7, 8, 10
- Red Hat AI Inference Server 3.3.3

## Timeline

- 2026-03-10: advisory: Initial advisory published by Facebook and NVD
- 2026-03-10: patched: Patch committed to giflib SourceForge repository
- 2026-05-11: advisory: Red Hat published multiple security advisories (RHSA) for affected products

## References

- [https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106/tree/gifalloc.c?diff=5146815377b7395944cb683a08c43eee3f631eb7](https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106/tree/gifalloc.c?diff=5146815377b7395944cb683a08c43eee3f631eb7)
- [https://www.facebook.com/security/advisories/cve-2026-23868](https://www.facebook.com/security/advisories/cve-2026-23868)
- [https://access.redhat.com/errata/RHSA-2026:16008](https://access.redhat.com/errata/RHSA-2026:16008)
- [https://access.redhat.com/errata/RHSA-2026:16009](https://access.redhat.com/errata/RHSA-2026:16009)
- [https://access.redhat.com/errata/RHSA-2026:16030](https://access.redhat.com/errata/RHSA-2026:16030)
- [https://access.redhat.com/errata/RHSA-2026:16174](https://access.redhat.com/errata/RHSA-2026:16174)
- [https://access.redhat.com/errata/RHSA-2026:19154](https://access.redhat.com/errata/RHSA-2026:19154)

## Related threats

- [vLLM improper image metadata normalization in image processing](https://junglewise.ai/threats/vllm-improper-image-metadata-normalization-in-image-processing-68504b9d)
- [vLLM improper image metadata handling in image processing](https://junglewise.ai/threats/cve-2026-12491-vllm-improper-image-metadata-handling-in-image-processing)
- [Kludex python-multipart denial of service in multipart header parsing](https://junglewise.ai/threats/cve-2026-42561-kludex-python-multipart-denial-of-service-in-multipart-header)
- [Apache Thrift improper certificate validation in Java TSSLTransportFactory](https://junglewise.ai/threats/cve-2026-41603-apache-thrift-improper-certificate-validation-in-java)
- [Apache Thrift integer overflow in Go TFramedTransport](https://junglewise.ai/threats/cve-2026-41602-apache-thrift-integer-overflow-in-go-tframedtransport)