#199 Buffer Overflow vulnerability in giflib

[Gayathri Venkat]

There is a CVE https://cve-searcher.ipws.mathworks.com/?list=CVE-2026-26740 existing in v6.1.3.

More details and PoC can be found here - https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_len_heap_oobwrite_disclosure.md

It is a heap-based out-of-bounds write in EGifGCBToExtension() within egif_lib.c. A crafted GIF with a truncated Graphics Control Extension (GCE) block (e.g., length 1 instead of the expected 4) causes the code to write 4 bytes into a 1-byte heap allocation.

[Michal Hlavinka]

I can confirm that with provided poc.gif the problem can be reproduced by running giftool with valgrind:

==56559== Invalid write of size 1
==56559==    at 0x488933B: EGifGCBToExtension (in /usr/lib64/libgif.so.7.1.0)
==56559==    by 0x488D93A: EGifGCBToSavedExtension (in /usr/lib64/libgif.so.7.1.0)
==56559==    by 0x4000F03: ??? (in /usr/bin/giftool)
==56559==    by 0x48985B4: (below main) (libc_start_call_main.h:58)
...

I've added a fix to my build - same check as is in the reverse function DGifExtensionToGCB in dgif_lib.c to return GIF_ERROR if ep->ByteCount != 4. With this change, there are no valgrind errors.

[Eric S. Raymond]

Fix applied and pushed