Executive brief
A vulnerability exists in the bitbank2 AnimatedGIF library, which is used by developers to display and process animated GIF images in applications. By providing a specially crafted GIF file, an attacker can cause the application to crash or potentially take control of the system. This could lead to service outages or the theft of sensitive information depending on how the library is integrated into the software.
Technical details
A heap-based buffer overflow exists in the DecodeLZW function within src/AnimatedGIF.h of the bitbank2 AnimatedGIF library. The vulnerability is caused by insufficient bounds checking when accessing the LZW dictionary and output buffer during decompression. Specifically, the code fails to validate LZW codes against the maximum dictionary size (4096) and does not properly check the pDraw->iTBD index against allocated buffer boundaries. An attacker can exploit this by providing a malformed GIF file, leading to out-of-bounds writes. This can result in memory corruption, application crashes (SIGSEGV/SIGBUS), or remote code execution. The issue was identified via fuzzing and confirmed with AddressSanitizer (ASan).
Affected products
- bitbank2 AnimatedGIF 2.2.0 and earlier
Timeline
- 2026-01-27: disclosed: Issue reported on GitHub repository
- 2026-06-09: advisory: CVE published by NVD/MITRE