Skip to main content

N A EUVDEUVD-2026-12914

| CVE-2026-26740 HIGH
Out-of-bounds Write (CWE-787)
2026-03-18 mitre
Buffer Overflow Denial Of Service Memory Corruption N A
8.2
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

5
Patch released
Apr 10, 2026 - 08:30 nvd
Patch available
PoC Detected
Mar 21, 2026 - 00:09 vuln.today
Public exploit code
EUVD ID Assigned
Mar 18, 2026 - 18:15 euvd
EUVD-2026-12914
Analysis Generated
Mar 18, 2026 - 18:15 vuln.today
CVE Published
Mar 18, 2026 - 00:00 nvd
HIGH 8.2

DescriptionCVE.org

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size.

AnalysisAI

Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when processing Graphic Control Extension blocks, enabling remote attackers to trigger denial of service conditions. Public exploit code exists for this vulnerability, though no patch is currently available. The flaw affects any application using the vulnerable giflib version to process GIF files from untrusted sources.

Technical ContextAI

Giflib is a widely-used C library for reading and writing GIF image files, commonly integrated into image processing tools, web servers, and multimedia applications. The vulnerability resides in the EGifGCBToExtension function, which handles Graphic Control Extension (GCE) blocks—metadata structures in GIF files that define animation timing and transparency. The root cause is insufficient bounds checking (CWE-120: Buffer Copy without Checking Size of Input) when the function overwrites existing GCE blocks without verifying that the destination buffer has sufficient allocated memory. When processing a specially crafted GIF, an attacker can write beyond buffer boundaries, corrupting heap memory and triggering a crash or undefined behavior. The affected product is giflib (identified in CPE nomenclature, though vendor-neutral CPE strings suggest broad applicability across multiple downstream consumers).

RemediationAI

Upgrade giflib to version 5.2.3 or later (refer to the official giflib repository at https://github.com/jhalley/giflib for patched releases). For applications unable to upgrade immediately, implement input validation by rejecting or sandboxing untrusted GIF files, and monitor for application crashes or unexpected exits when processing GIF input. Deploy network-based protections to restrict GIF file uploads to trusted sources only. If giflib is embedded in a third-party application, contact the vendor for an updated build that includes patched giflib dependencies. Automated dependency scanning tools should flag any remaining installations of giflib versions prior to 5.2.3.

More in N A

View all
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
CVE-2026-45185 CRITICAL POC
9.8 May 12

Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
CVE-2025-50455 CRITICAL POC
9.1 Jul 27

SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
CVE-2026-36356 CRITICAL POC
9.1 May 05

Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
CVE-2026-31071 CRITICAL POC
9.1 May 19

Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
CVE-2025-66391 HIGH POC
8.8 Jun 17

Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
CVE-2025-60464 HIGH POC
7.8 Jun 25

Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
CVE-2026-36355 HIGH POC
7.7 May 05

Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
CVE-2025-60474 HIGH POC
7.5 Jun 24

Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
CVE-2026-38639 HIGH POC
7.5 Jun 26

Denial of service in relibc — the Redox OS C standard library implemented in Rust — allows attackers to crash applicatio

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

EUVD-2026-12914 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy