Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat giflib Update: Malicious GIFs Can Execute Code

published 4 months ago

Summary

An update is available for giflib, a library for working with GIF images. If a user opens a malicious GIF, an attacker could potentially execute code on the user's system. To protect your system, update giflib to the latest version.

What to do

Update redhat giflib to version 0:5.2.1-9.el9_2.2.
Update redhat giflib-debuginfo to version 0:5.2.1-9.el9_2.2.
Update redhat giflib-debugsource to version 0:5.2.1-9.el9_2.2.
Update redhat giflib-utils-debuginfo to version 0:5.2.1-9.el9_2.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.2::appstream	redhat	giflib	< 0:5.2.1-9.el9_2.2 Fix: upgrade to 0:5.2.1-9.el9_2.2
Red Hat:rhel_e4s:9.2::appstream	redhat	giflib-debuginfo	< 0:5.2.1-9.el9_2.2 Fix: upgrade to 0:5.2.1-9.el9_2.2
Red Hat:rhel_e4s:9.2::appstream	redhat	giflib-debugsource	< 0:5.2.1-9.el9_2.2 Fix: upgrade to 0:5.2.1-9.el9_2.2
Red Hat:rhel_e4s:9.2::appstream	redhat	giflib-utils-debuginfo	< 0:5.2.1-9.el9_2.2 Fix: upgrade to 0:5.2.1-9.el9_2.2

Original advisory text

Red Hat Security Advisory: giflib security update

References

https://access.redhat.com/errata/RHSA-2026:33509 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2448747 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33509.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-26740 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-26740 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-26740 Vendor Advisory
https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_le... Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published1 Jul 2026

Updated1 Jul 2026

First seen1 Jul 2026

Sources

RHSA-2026:33509 · OSV

Track software like this

Free during beta