CVE-2026-23868: Double Free
Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/giflibto a version that resolves this vulnerability.Fixed in 5.1.9-2+deb11u1Fixed in 5.2.1-2.5+deb12u1Fixed in 5.2.2-1+deb13u1Fixed in 6.1.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23868?
CVE-2026-23868 is classified as a moderate severity vulnerability due to the complexity of triggering the double-free condition.
How do I fix CVE-2026-23868?
To mitigate CVE-2026-23868, ensure you apply the latest updates and patches provided for the affected versions of giflib.
What are the affected software versions for CVE-2026-23868?
CVE-2026-23868 affects Microsoft azl3 giflib 5.2.1-10 and Microsoft cbl2 giflib 5.2.1-10.
What type of vulnerability is CVE-2026-23868?
CVE-2026-23868 is a double-free vulnerability caused by shallow copying in GifMakeSavedImage and poor error handling.
Are there any known exploits for CVE-2026-23868?
At present, there are no widely reported exploits specifically targeting CVE-2026-23868, but the potential for exploitation exists under certain conditions.