A double-free vulnerability (CVE-2026-23868, CVSS 5.1 MEDIUM) in the giflib library can lead to memory corruption when processing GIF files. The flaw affects Red Hat Enterprise Linux 9, and Red Hat has released a security update rated Important to address it. Administrators should apply the provided giflib package updates for their specific architecture.
Red Hat Product Errata RHSA-2026:8859 - Security Advisory Issued: 2026-04-20 Updated: 2026-04-20 RHSA-2026:8859 - Security Advisory Overview Updated Packages Synopsis Important: giflib security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for giflib is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description giflib is a library for reading and writing gif images. Security Fix(es): giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for x86_64 9 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x Fixes BZ - 2446207 - CVE-2026-23868 giflib: Giflib: Double-free vulnerability leading to memory corruption CVEs CVE-2026-23868 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM giflib-5.2.1-9.el9_7.1.src.rpm SHA-256: 45d5282834734ea5d20e888d73f48194709bbe856d84c61af560b590fd11429e x86_64 giflib-5.2.1-9.el9_7.1.i686.rpm SHA-256: 05ec34b1a563048cd28afe234995cda726e55b9be45552b9629236cb4155283b giflib-5.2.1-9.el9_7.1.x86_64.rpm SHA-256: 01824961a0710ecb37cddfdb0d5c0603a8f8f242d361e1b40c0f964002199dda giflib-debuginfo-5.2.1-9.el9_7.1.i686.rpm SHA-256: 88b75610d0cbcebacd0270041efeb88f0bcfb95e08f4dd7861d486e9171d8621 giflib-debuginfo-5.2.1-9.el9_7.1.x86_64.rpm SHA-256: 380814313bb53c6acf650a0d9a58546b072ef3529d3cd68ec9b95934ff4d6901 giflib-debugsource-5.2.1-9.el9_7.1.i686.rpm SHA-256: e0c0a62dbebbb5f953c789e1a3c86cc6bea29315c91829632811843ee8d70428 giflib-debugsource-5.2.1-9.el9_7.1.x86_64.rpm SHA-256: 24afd589206d851b79881d4f39ba793015f42db40c5015d39efa378b42c4f6be giflib-utils-debuginfo-5.2.1-9.el9_7.1.i686.rpm SHA-256: e24bf41981d42d8b80d24ed274f9662ca2afd325973ba40cea4eed7f01bd9509 giflib-utils-debuginfo-5.2.1-9.el9_7.1.x86_64.rpm SHA-256: 01bad023290c6a3b26abba0ab46616867a478f519792d4af3df1be078bd7f16c Red Hat Enterprise Linux for IBM z Systems 9 SRPM giflib-5.2.1-9.el9_7.1.src.rpm SHA-256: 45d5282834734ea5d20e888d73f48194709bbe856d84c61af560b590fd11429e s390x giflib-5.2.1-9.el9_7.1.s390x.rpm SHA-256: edc4a8d944c4b688ac09d3a6c06bd6cc521c007ceb329be0f8aa41408010311f giflib-debuginfo-5.2.1-9.el9_7.1.s390x.rpm SHA-256: 9ce9b1f3d5cf0b6d741d6a84cc26bc2d232b39a3ffd7cebc39efa58f0f8f6a0c giflib-debugsource-5.2.1-9.el9_7.1.s390x.rpm SHA-256: 6b8fe37d56d7cda2f1e0b6f4814f6af3dba35a8ab47d8bc15b1bd1e1c5b70e50 giflib-utils-debuginfo-5.2.1-9.el9_7.1.s390x.rpm SHA-256: 7353a0fc3ce7aef0f9ce902cf95c8e8872549e052a4abcea801d4694c2543986 Red Hat Enterprise Linux for Power, little endian 9 SRPM giflib-5.2.1-9.el9_7.1.src.rpm SHA-256: 45d5282834734ea5d20e888d73f48194709bbe856d84c61af560b590fd11429e ppc64le giflib-5.2.1-9.el9_7.1.ppc64le.rpm SHA-256: dd08c3890305bb40de226ab6e331c3df03df8a7dce737dc05ba503ac2b00c218 giflib-debuginfo-5.2.1-9.el9_7.1.ppc64le.rpm SHA-256: fdcd082662164484a0cf2b2559724ebe1bc3cc3b44729a287771d471b7ae9e93 giflib-debugsource-5.2.1-9.el9_7.1.ppc64le.rpm SHA-256: 3fb99a9d824fe1ac7b46e21f608ecb3e154a8e770f56c57fd2e028a704a6042c giflib-utils-debuginfo-5.2.1-9.el9_7.1.ppc64le.rpm SHA-256: bd752c742ef9c040e2cf9fa6194808f9db5e0fbce062de204667a50949f6d6c1 Red Hat Enterprise Linux for ARM 64 9 SRPM giflib-5.2.1-9.el9_7.1.src.rpm SHA-256: 45d5282834734ea5d20e888d73f48194709bbe856d84c61af560b590fd11429e aarch64 giflib-5.2.1-9.el9_7.1.aarch64.rpm SHA-256: 54a9552bcc43457041ddd5b42ee87a873b4128ae7144ac6d4b0a304393245076 giflib-debuginfo-5.2.1-9.el9_7.1.aarch64.rpm SHA-256: e3db1180adcc43a8731b801038f10cfb55d2d982b437d65747b841727f80b49e giflib-debugsource-5.2.1-9.el9_7.1.aarch64.rpm SHA-256: 3084b81373c2622e296c5e8f0a717b3bd7addbd20ba83e7ec7a6b472d9c32577 giflib-utils-debuginfo-5.2.1-9.el9_7.1.aarch64.rpm SHA-256: 3ce38ea75e26fb76b35614dd22a8833244da7163aa8d9661de1133e41c1dc844 Red Hat CodeReady Linux Builder for x86_64 9 SRPM x86_64 giflib-debuginfo-5.2.1-9.el9_7.1.i686.rpm SHA-256: 88b75610d0cbcebacd0270041efeb88f0bcfb95e08f4dd7861d486e9171d8621 giflib-debuginfo-5.2.1-9.el9_7.1.x86_64.rpm SHA-256: 380814313bb53c6acf650a0d9a58546b072ef3529d3cd68ec9b95934ff4d6901 giflib-debugsource-5.2.1-9.el9_7.1.i686.rpm SHA-256: e0c0a62dbebbb5f953c789e1a3c86cc6bea29315c91829632811843ee8d70428 giflib-debugsource-5.2.1-9.el9_7.1.x86_64.rpm SHA-256: 24afd589206d851b79881d4f39ba793015f42db40c5015d39efa378b42c4f6be giflib-devel-5.2.1-9.el9_7.1.i686.rpm SHA-256: 749cf3a698c713801a8e8c8e02ca0c2133ef8d5c8860e9ec10587e2aba6b8335 giflib-devel-5.2.1-9.el9_7.1.x86_64.rpm SHA-256: 02dded2cfe1f76657dcf88d6573688801514a59255a5ba4d2c352b5e87a690e4 giflib-utils-debuginfo-5.2.1-9.el9_7.1.i686.rpm SHA-256: e24bf41981d42d8b80d24ed274f9662ca2afd325973ba40cea4eed7f01bd9509 giflib-utils-debuginfo-5.2.1-9.el9_7.1.x86_64.rpm SHA-256: 01bad023290c6a3b26abba0ab46616867a478f519792d4af3df1be078bd7f16c Red Hat CodeReady Linux Builder for Power, little endian 9 SRPM ppc64le giflib-debuginfo-5.2.1-9.el9_7.1.ppc64le.rpm SHA-256: fdcd082662164484a0cf2b2559724ebe1bc3cc3b44729a287771d471b7ae9e93 giflib-debugsource-5.2.1-9.el9_7.1.ppc64le.rpm SHA-256: 3fb99a9d824fe1ac7b46e21f608ecb3e154a8e770f56c57fd2e028a704a6042c giflib-devel-5.2.1-9.el9_7.1.ppc64le.rpm SHA-256: 21fe44a0c8cd254e1d6f33f3ac6095e14f454d71a11da44fddcf858eac27670f giflib-utils-debuginfo-5.2.1-9.el9_7.1.ppc64le.rpm SHA-256: bd752c742ef9c040e2cf9fa6194808f9db5e0fbce062de204667a50949f6d6c1 Red Hat CodeReady Linux Builder for ARM 64 9 SRPM aarch64 giflib-debuginfo-5.2.1-9.el9_7.1.aarch64.rpm SHA-256: e3db1180adcc43a8731b801038f10cfb55d2d982b437d65747b841727f80b49e giflib-debugsource-5.2.1-9.el9_7.1.aarch64.rpm SHA-256: 3084b81373c2622e296c5e8f0a717b3bd7addbd20ba83e7ec7a6b472d9c32577 giflib-devel-5.2.1-9.el9_7.1.aarch64.rpm SHA-256: 8a18278eb2c4d78d926008fde8e295c45967559df6973da3f51f899256013a64 giflib-utils-debuginfo-5.2.1-9.el9_7.1.aarch64.rpm SHA-256: 3ce38ea75e26fb76b35614dd22a8833244da7163aa8d9661de1133e41c1dc844 Red Hat CodeReady Linux Builder for IBM z Systems 9 SRPM s390x giflib-debuginfo-5.2.1-9.el9_7.1.s390x.rpm SHA-256: 9ce9b1f3d5cf0b6d741d6a84cc26bc2d232b39a3ffd7cebc39efa58f0f8f6a0c giflib-debugsource-5.2.1-9.el9_7.1.s390x.rpm SHA-256: 6b8fe37d56d7cda2f1e0b6f4814f6af3dba35a8ab47d8bc15b1bd1e1c5b70e50 giflib-devel-5.2.1-9.el9_7.1.s390x.rpm SHA-256: defdbdf200fb27a60fa945f16e9a79a91cc54cfb6233f96a4f4d53857338b4a6 giflib-utils-debuginfo-5.2.1-9.el9_7.1.s390x.rpm SHA-256: 7353a0fc3ce7aef0f9ce902cf95c8e8872549e052a4abcea801d4694c2543986 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .