# CVE-2026-23868: Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible. CVE-2026-23868 is fixed in 14 products on 1 platform, first by RHSA-2026:9290, released March 10, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-23868 - Priority: High - CVSS: 7.0 (Important) - EPSS: 0.0017 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 10, 2026 - Weakness: Double Free - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23868 ## Description Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | giflib Debian 12.15 (bookworm) | 5.2.1-2.5+deb12u1 | [DEBIAN-CVE-2026-23868](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23868.md) | Mar 10, 2026 | | Linux | giflib Debian 13.5 (trixie) | 5.2.2-1+deb13u1 | [DEBIAN-CVE-2026-23868](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23868.md) | Mar 10, 2026 | | Linux | giflib Debian 14 | 6.1.3-1 | [DEBIAN-CVE-2026-23868](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23868.md) | Mar 10, 2026 | | Linux | giflib Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | giflib RHEL 10 | 5.2.1-22.el10_0.1 | [RHSA-2026:9290](https://patchblox.com/security/data/fix/linux/rhsa-2026-9290.md) | Mar 10, 2026 | | Linux | giflib RHEL 8 | 0:5.1.4-4.el8_10 | [RHSA-2026:8861](https://patchblox.com/security/data/fix/linux/rhsa-2026-8861.md) | Apr 30, 2026 | | Linux | giflib RHEL 9 | 0:5.2.1-9.el9_7.1 | [RHSA-2026:8859](https://patchblox.com/security/data/fix/linux/rhsa-2026-8859.md) | Apr 30, 2026 | | Linux | giflib almalinux 10 | 5.2.1-24.el10_2 | [ALSA-2026:19154](https://patchblox.com/security/data/fix/linux/alsa-2026-19154.md) | May 19, 2026 | | Linux | giflib almalinux 8 | 5.1.4-4.el8_10 | [ALSA-2026:8861](https://patchblox.com/security/data/fix/linux/alsa-2026-8861.md) | Apr 20, 2026 | | Linux | giflib almalinux 9 | 5.2.1-10.el9_8.1 | [ALSA-2026:19367](https://patchblox.com/security/data/fix/linux/alsa-2026-19367.md) | May 19, 2026 | | Linux | giflib amzn 2023 | 5.2.1-9.amzn2023.0.3 | [ALAS2023-2026-1508](https://patchblox.com/security/data/fix/linux/alas2023-2026-1508.md) | Mar 30, 2026 | | Linux | giflib ol 10 | 0:5.2.1-22.el10_1.1 | [ELSA-2026-8858](https://patchblox.com/security/data/fix/linux/elsa-2026-8858.md) | Apr 19, 2026 | | Linux | giflib ol 8 | 0:5.1.4-4.el8_10 | [ELSA-2026-8861](https://patchblox.com/security/data/fix/linux/elsa-2026-8861.md) | Apr 20, 2026 | | Linux | giflib ol 9 | 0:5.2.1-9.el9_7.1 | [ELSA-2026-8859](https://patchblox.com/security/data/fix/linux/elsa-2026-8859.md) | Apr 20, 2026 | | Linux | giflib opensuse-leap 15.6 | 5.2.2-150000.4.19.1 | [SUSE-SU-2026:1338-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1338-1.md) | Apr 15, 2026 | | Linux | giflib opensuse-leap 16.0 | 5.2.2-160000.3.1 | [OPENSUSE-SU-2026:20601-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20601-1.md) | Apr 22, 2026 | | Linux | giflib rocky 10 | 0:5.2.1-24.el10_2 | [RLSA-2026:19154](https://patchblox.com/security/data/fix/linux/rlsa-2026-19154.md) | May 29, 2026 | | Linux | giflib rocky 8 | 0:5.1.4-4.el8_10 | [RLSA-2026:8861](https://patchblox.com/security/data/fix/linux/rlsa-2026-8861.md) | Apr 23, 2026 | | Linux | giflib rocky 9 | 0:5.2.1-10.el9_8.1 | [RLSA-2026:19367](https://patchblox.com/security/data/fix/linux/rlsa-2026-19367.md) | May 28, 2026 | | Linux | giflib sles 15.7 | 5.2.2-150000.4.19.1 | [SUSE-SU-2026:1338-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1338-1.md) | Apr 15, 2026 | | Linux | giflib-debuginfo Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | giflib-debuginfo amzn 2023 | 5.2.1-9.amzn2023.0.3 | [ALAS2023-2026-1508](https://patchblox.com/security/data/fix/linux/alas2023-2026-1508.md) | Mar 30, 2026 | | Linux | giflib-debugsource Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | giflib-debugsource amzn 2023 | 5.2.1-9.amzn2023.0.3 | [ALAS2023-2026-1508](https://patchblox.com/security/data/fix/linux/alas2023-2026-1508.md) | Mar 30, 2026 | | Linux | giflib-devel Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | giflib-devel RHEL 8 | 0:5.1.4-4.el8_10 | [RHSA-2026:8861](https://patchblox.com/security/data/fix/linux/rhsa-2026-8861.md) | Apr 30, 2026 | | Linux | giflib-devel RHEL 9 | 0:5.2.1-9.el9_7.1 | [RHSA-2026:8859](https://patchblox.com/security/data/fix/linux/rhsa-2026-8859.md) | Apr 30, 2026 | | Linux | giflib-devel almalinux 10 | 5.2.1-24.el10_2 | [ALSA-2026:19154](https://patchblox.com/security/data/fix/linux/alsa-2026-19154.md) | May 19, 2026 | | Linux | giflib-devel almalinux 8 | 5.1.4-4.el8_10 | [ALSA-2026:8861](https://patchblox.com/security/data/fix/linux/alsa-2026-8861.md) | Apr 20, 2026 | | Linux | giflib-devel almalinux 9 | 5.2.1-10.el9_8.1 | [ALSA-2026:19367](https://patchblox.com/security/data/fix/linux/alsa-2026-19367.md) | May 19, 2026 | | Linux | giflib-devel amzn 2023 | 5.2.1-9.amzn2023.0.3 | [ALAS2023-2026-1508](https://patchblox.com/security/data/fix/linux/alas2023-2026-1508.md) | Mar 30, 2026 | | Linux | giflib-devel ol 10 | 0:5.2.1-22.el10_1.1 | [ELSA-2026-8858](https://patchblox.com/security/data/fix/linux/elsa-2026-8858.md) | Apr 19, 2026 | | Linux | giflib-devel ol 8 | 0:5.1.4-4.el8_10 | [ELSA-2026-8861](https://patchblox.com/security/data/fix/linux/elsa-2026-8861.md) | Apr 20, 2026 | | Linux | giflib-devel ol 9 | 0:5.2.1-9.el9_7.1 | [ELSA-2026-8859](https://patchblox.com/security/data/fix/linux/elsa-2026-8859.md) | Apr 20, 2026 | | Linux | giflib-tools Ubuntu 22.04.1 LTS (jammy) | 5.1.9-2ubuntu0.3 | [giflib-tools 5.1.9-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-giflib-tools-5.1.9-2ubuntu0.3.md) | Mar 18, 2026 | | Linux | giflib-tools Ubuntu 24.04.5 LTS (noble) | 5.2.2-1ubuntu1.2 | [giflib-tools 5.2.2-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-giflib-tools-5.2.2-1ubuntu1.2.md) | Mar 18, 2026 | | Linux | giflib-tools Ubuntu 26.04.1 LTS (resolute) | 5.2.2-1ubuntu3.2 | [giflib-tools 5.2.2-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-giflib-tools-5.2.2-1ubuntu3.2.md) | Mar 18, 2026 | | Linux | giflib-utils Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | giflib-utils amzn 2023 | 5.2.1-9.amzn2023.0.3 | [ALAS2023-2026-1508](https://patchblox.com/security/data/fix/linux/alas2023-2026-1508.md) | Mar 30, 2026 | | Linux | giflib-utils-debuginfo Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | giflib-utils-debuginfo amzn 2023 | 5.2.1-9.amzn2023.0.3 | [ALAS2023-2026-1508](https://patchblox.com/security/data/fix/linux/alas2023-2026-1508.md) | Mar 30, 2026 | | Linux | libgif7 Ubuntu 22.04.1 LTS (jammy) | 5.1.9-2ubuntu0.3 | [libgif7 5.1.9-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libgif7-5.1.9-2ubuntu0.3.md) | Mar 18, 2026 | | Linux | libgif7 Ubuntu 24.04.5 LTS (noble) | 5.2.2-1ubuntu1.2 | [libgif7 5.2.2-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libgif7-5.2.2-1ubuntu1.2.md) | Mar 18, 2026 | | Linux | libgif7 Ubuntu 26.04.1 LTS (resolute) | 5.2.2-1ubuntu3.2 | [libgif7 5.2.2-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libgif7-5.2.2-1ubuntu3.2.md) | Mar 18, 2026 | | Linux | mingw32-giflib Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | mingw32-giflib-debuginfo Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | mingw32-giflib-tools Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | mingw64-giflib Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | mingw64-giflib-debuginfo Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | | Linux | mingw64-giflib-tools Fedora 43 | 5.2.2-9.fc43 | [FEDORA-2026-C260342365](https://patchblox.com/security/data/fix/linux/fedora-2026-c260342365.md) | Mar 21, 2026 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.