Read the docs
TI-2026-21378 Aliases CVE-2026-26740GHSA-g43h-fmhp-fvff

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a…

Priority HIGH 75CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 31 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00657 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 23 advisoriesRed Hat: 31 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:giflib_project:giflib:5.2.2:*:*:*:*:*:*:*5.2.2VulnerableGiflib Project
  • cpe:2.3:a:giflib_project:giflib:5.2.2:*:*:*:*:*:*:* Versions 5.2.2 Vulnerable ·Giflib Project

Remediation

Red Hat 23 advisories

  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:36006 Released 2026-07-06 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:36005 Released 2026-07-06 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
Show 20 more Red Hat advisories
  • RHSA-2026:36004 Released 2026-07-06 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:33501 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream (v. 9) giflib-5.2.1-10.el9_8.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) giflib-devel-5.2.1-10.el9_8.2
  • RHSA-2026:33502 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream (v. 10) giflib-5.2.1-25.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) giflib-devel-5.2.1-25.el10_2
  • RHSA-2026:33503 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream (v. 8) giflib-5.1.4-5.el8_10
    • Red Hat Enterprise Linux CRB (v. 8) giflib-devel-5.1.4-5.el8_10
  • RHSA-2026:33509 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) giflib-5.2.1-9.el9_2.2
  • RHSA-2026:33456 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) giflib-5.1.4-3.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) giflib-5.1.4-3.el8_8.2
  • RHSA-2026:33452 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) giflib-5.2.1-9.el9_4.2
  • RHSA-2026:33455 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) giflib-5.1.4-3.el8_6.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) giflib-5.1.4-3.el8_6.2
  • RHSA-2026:33451 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) giflib-devel-5.2.1-9.el9_6.2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) giflib-5.2.1-9.el9_6.2
  • RHSA-2026:33450 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) giflib-5.1.4-3.el8_4.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) giflib-5.1.4-3.el8_4.2
  • RHSA-2026:33447 Released 2026-06-30 · Red Hat rating Important
    giflib security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) giflib-5.2.1-22.el10_0.2
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) giflib-devel-5.2.1-22.el10_0.2
  • RHSA-2026:9689 Released 2026-04-24 · Red Hat rating Important
    java-21-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 10) java-21-openjdk-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-2.el10_2 +6
    • Red Hat Enterprise Linux AppStream (v. 8) java-21-openjdk-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-1:21.0.11.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-21-openjdk-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-1:21.0.11.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) java-21-openjdk-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-1.el10_2 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el9 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el10_2 +11
  • RHSA-2026:9683 Released 2026-04-24 · Red Hat rating Important
    java-1.8.0-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat Enterprise Linux AppStream (v. 8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream (v. 9) java-1.8.0-openjdk-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-2.el9 +4
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux CRB (v. 8) java-1.8.0-openjdk-accessibility-fastdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-slowdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-2.el9 +7
  • RHSA-2026:9686 Released 2026-04-24 · Red Hat rating Important
    java-17-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-1:17.0.19.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8 +20
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-2.el9 +11
  • RHSA-2026:9690 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 21.0.11 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 21.0.11
  • RHSA-2026:9694 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 25.0.3 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 25.0.3
  • RHSA-2026:9684 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 8u492 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 8u492
  • RHSA-2026:9687 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 17.0.19 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 17.0.9
  • RHSA-2026:9693 Released 2026-04-22 · Red Hat rating Important
    java-25-openjdk security update
    • Red Hat Enterprise Linux AppStream (v. 10) java-25-openjdk-1:25.0.3.0.9-1.el10_2, java-25-openjdk-crypto-adapter-1:25.0.3.0.9-1.el10_2, java-25-openjdk-demo-1:25.0.3.0.9-1.el10_2 +7
    • Red Hat Enterprise Linux AppStream (v. 9) java-25-openjdk-1:25.0.3.0.9-1.el9, java-25-openjdk-crypto-adapter-1:25.0.3.0.9-1.el9, java-25-openjdk-demo-1:25.0.3.0.9-1.el9 +7
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.3.0.9-1.el10_2, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.3.0.9-1.el10_2, java-25-openjdk-demo-fastdebug-1:25.0.3.0.9-1.el10_2 +13
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.3.0.9-1.el9, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.3.0.9-1.el9, java-25-openjdk-demo-fastdebug-1:25.0.3.0.9-1.el9 +13
  • RHSA-2026:9255 Released 2026-04-22 · Red Hat rating Important
    OpenJDK 11.0.31 ELS Security Update for Portable Linux Builds
    • OPENJDK ELS 11.0.31

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
OPENJDK ELS 11.0.31Fixed RHSA-2026:9255
Red Hat AI Inference Server 3.2Fixed RHSA-2026:36004, RHSA-2026:36005, RHSA-2026:36006
Red Hat Build of OpenJDK 17.0.9Fixed RHSA-2026:9687
Red Hat Build of OpenJDK 21.0.11Fixed RHSA-2026:9690
Red Hat Build of OpenJDK 25.0.3Fixed RHSA-2026:9694
Red Hat Build of OpenJDK 8u492Fixed RHSA-2026:9684
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:33451, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:33502, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:33503, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:33501, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:9683
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:33450, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:33455, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:33456, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:33509, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:33452
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:33447, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:33451, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:33450, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:33455
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:33456, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:33503, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:33502, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:33501, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:33447, RHSA-2026:9689
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat build of OpenJDK 11 ELS

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26740
  2. 2026-10-03 Alias added: GHSA-g43h-fmhp-fvff
  3. 2026-10-09 Fix available: RHSA-2026:9255 · Red Hat
  4. 2026-10-30 Fix available: RHSA-2026:9684 · Red Hat
  5. 2026-10-30 Fix available: RHSA-2026:9694 · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:9690 · Red Hat
  7. 2026-10-30 Fix available: OPENJDK ELS 11.0.31, Red Hat Build of OpenJDK 21.0.11, Red Hat Build of OpenJDK 25.0.3 +1 · Red Hat
  8. 2026-10-31 Fix available: RHSA-2026:9687 · Red Hat
  9. 2026-10-31 Fix available: Red Hat Build of OpenJDK 17.0.9 · Red Hat

References

Exploit 1

  • TI-2024-30864 Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. CVSS 3.1MEDIUM 6.5
  • TI-2023-20770 giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. CVSS 3.1MEDIUM 5.5
  • TI-2016-02665 Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2… CVSS 3.0CRITICAL 9.8
  • TI-2018-08211 The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as… CVSS 3.1HIGH 8.8
  • TI-2018-08210 The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as… CVSS 3.1HIGH 8.8
  • TI-2021-17617 A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote… CVSS 3.1HIGH 8.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences