Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat giflib Security Update Allows Remote Code Execution

published 4 months ago

Summary

A security update has been released for giflib, a library used by various applications to handle GIF images. This update addresses a vulnerability that could allow an attacker to execute malicious code on a user's system if they are tricked into viewing a specially crafted GIF image. It is recommended to update to the latest version of giflib to ensure your system is secure.

What to do

Update redhat giflib-devel to version 0:5.1.4-5.el8_10.
Update redhat giflib-debugsource to version 0:5.1.4-5.el8_10.
Update redhat giflib to version 0:5.1.4-5.el8_10.
Update redhat giflib-debuginfo to version 0:5.1.4-5.el8_10.
Update redhat giflib-utils-debuginfo to version 0:5.1.4-5.el8_10.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::crb	redhat	giflib-devel	< 0:5.1.4-5.el8_10 Fix: upgrade to 0:5.1.4-5.el8_10
Red Hat:enterprise_linux:8::crb	redhat	giflib-debugsource	< 0:5.1.4-5.el8_10 Fix: upgrade to 0:5.1.4-5.el8_10
Red Hat:enterprise_linux:8::appstream	redhat	giflib	< 0:5.1.4-5.el8_10 Fix: upgrade to 0:5.1.4-5.el8_10
Red Hat:enterprise_linux:8::appstream	redhat	giflib-debuginfo	< 0:5.1.4-5.el8_10 Fix: upgrade to 0:5.1.4-5.el8_10
Red Hat:enterprise_linux:8::appstream	redhat	giflib-debugsource	< 0:5.1.4-5.el8_10 Fix: upgrade to 0:5.1.4-5.el8_10
Red Hat:enterprise_linux:8::appstream	redhat	giflib-utils-debuginfo	< 0:5.1.4-5.el8_10 Fix: upgrade to 0:5.1.4-5.el8_10
Red Hat:enterprise_linux:8::crb	redhat	giflib-debuginfo	< 0:5.1.4-5.el8_10 Fix: upgrade to 0:5.1.4-5.el8_10
Red Hat:enterprise_linux:8::crb	redhat	giflib-utils-debuginfo	< 0:5.1.4-5.el8_10 Fix: upgrade to 0:5.1.4-5.el8_10

Original advisory text

Red Hat Security Advisory: giflib security update

References

https://access.redhat.com/errata/RHSA-2026:33503 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2448747 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33503.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-26740 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-26740 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-26740 Vendor Advisory
https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_le... Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published1 Jul 2026

Updated1 Jul 2026

First seen1 Jul 2026

Sources

RHSA-2026:33503 · OSV

Track software like this

Free during beta