CVE-2025-31344

The giflib open-source component has a buffer overflow vulnerability

7.3 HighFix available

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: High

Exploit likelihood

0.26%Up 0.2 points since Apr 14, 2025

What each source reports

CVE List Score used 7.3

The giflib open-source component has a buffer overflow vulnerability

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Record: CVE-2025-31344
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2025-10875 7.3

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Record: EUVD-2025-10875
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4764-r75x-h867 7.3

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is...

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Record: GHSA-4764-r75x-h867
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-122
Updated: 2026-11-02

NVD 7.3

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Record: CVE-2025-31344
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-122
Updated: 2026-11-02

OSVALPINE-CVE-2025-31344 7.3

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Record: ALPINE-CVE-2025-31344
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVBELL-CVE-2025-31344 7.3

Record: BELL-CVE-2025-31344
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

Show 17 moreShow less

OSVDEBIAN-CVE-2025-31344 7.3

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2.

Record: DEBIAN-CVE-2025-31344
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-1380 7.3

giflib security update

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

openeuler社区开源软件giflib存在堆缓冲区溢出漏洞，通过未gif2rgb构造异常输入，造成内存越界读(CVE-2025-31344)

Record: OESA-2025-1380
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-1381 7.3

giflib security update

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

openeuler社区开源软件giflib存在堆缓冲区溢出漏洞，通过未gif2rgb构造异常输入，造成内存越界读(CVE-2025-31344)

Record: OESA-2025-1381
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-1382 7.3

giflib security update

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

openeuler社区开源软件giflib存在堆缓冲区溢出漏洞，通过未gif2rgb构造异常输入，造成内存越界读(CVE-2025-31344)

Record: OESA-2025-1382
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-1383 7.3

giflib security update

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

openeuler社区开源软件giflib存在堆缓冲区溢出漏洞，通过未gif2rgb构造异常输入，造成内存越界读(CVE-2025-31344)

Record: OESA-2025-1383
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-1388 7.3

giflib security update

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

openeuler社区开源软件giflib存在堆缓冲区溢出漏洞，通过未gif2rgb构造异常输入，造成内存越界读(CVE-2025-31344)

Record: OESA-2025-1388
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-1389 7.3

giflib security update

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

openeuler社区开源软件giflib存在堆缓冲区溢出漏洞，通过未gif2rgb构造异常输入，造成内存越界读(CVE-2025-31344)

Record: OESA-2025-1389
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-31344 7.3

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2.

Record: UBUNTU-CVE-2025-31344
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVAZL-60246 No score

CVE-2025-31344 affecting package giflib for versions less than 5.2.1-9

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Record: AZL-60246
Updated: 2026-11-02

OSVAZL-60261 No score

CVE-2025-31344 affecting package giflib for versions less than 5.2.1-10

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Record: AZL-60261
Updated: 2026-11-05

OSVCLSA-2025-1747903049 No score

giflib: Fix of 2 CVEs

CVE-2023-48161: fix heap-buffer overflow
CVE-2025-31344: fix heap-buffer overflow

Record: CLSA-2025-1747903049
Updated: 2026-11-02

OSV No score

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.

Record: CVE-2025-31344
Updated: 2026-11-02

OSVMGASA-2025-0135 No score

Updated giflib packages fix security vulnerability

The giflib open-source component has a buffer overflow vulnerability. (CVE-2025-31344)

Record: MGASA-2025-0135
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-31344 No score

CVE-2025-31344 in giflib - Patched by Root

Root has patched CVE-2025-31344 in the giflib package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-31344
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2025-31344 No score

CVE-2025-31344 in giflib - Patched by Root

Root has patched CVE-2025-31344 in the giflib package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2025-31344
Updated: 2026-11-02

OSVSUSE-SU-2025:1163-1 No score

Security update for giflib

This update for giflib fixes the following issues:

CVE-2025-31344: Fixed a buffer overflow in function DumpScreen2RGB (bsc#1240416)

Record: SUSE-SU-2025:1163-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1164-1 No score

Security update for giflib

This update for giflib fixes the following issues:

CVE-2025-31344: Fixed a buffer overflow in function DumpScreen2RGB (bsc#1240416)

Record: SUSE-SU-2025:1164-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`giflib` Alpine:v3.21	before 5.2.2-r1	5.2.2-r1
`giflib` Alpine:v3.22	before 5.2.2-r1	5.2.2-r1
`giflib` Alpine:v3.23	before 5.2.2-r1	5.2.2-r1
`giflib` Alpine:v3.24	before 5.2.2-r1	5.2.2-r1
`giflib` Azure Linux:2	before 5.2.1-9	5.2.1-9
`giflib` Azure Linux:3	before 5.2.1-10	5.2.1-10
`giflib` Alpaquita:23	5.2.1-r2 up to 5.2.2-r2	5.2.2-r2
`giflib` Alpaquita:stream	5.2.1-r2 up to 5.2.2-r1	5.2.2-r1
`giflib` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 5.2.1-9.el9.tuxcare.els1	5.2.1-9.el9.tuxcare.els1
`giflib-devel` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 5.2.1-9.el9.tuxcare.els1	5.2.1-9.el9.tuxcare.els1

Show 29 moreShow less

Affected packages
Package	Affected	Fixed
`giflib-utils` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 5.2.1-9.el9.tuxcare.els1	5.2.1-9.el9.tuxcare.els1
`giflib` Debian:12	All versions, plus listed versions 5.2.1-2.55.2.1-2.5+deb12u15.2.2-16.1.3-1	None known
`giflib` Debian:13	All versions, plus listed versions 5.2.2-15.2.2-1+deb13u16.1.3-1	None known
`giflib` Debian:14	before 6.1.3-1, plus listed versions 5.2.2-1	6.1.3-1
`giflib` Mageia:9	before 5.2.1-7.2.mga9	5.2.1-7.2.mga9
`giflib` openEuler:24.03-LTS	before 5.2.2-2.oe2403	5.2.2-2.oe2403
`giflib` openEuler:20.03-LTS-SP4	before 5.2.2-2.oe2003sp4	5.2.2-2.oe2003sp4
`giflib` openEuler:22.03-LTS-SP3	before 5.2.2-2.oe2203sp3	5.2.2-2.oe2203sp3
`giflib` openEuler:22.03-LTS-SP4	before 5.2.2-2.oe2203sp4	5.2.2-2.oe2203sp4
`giflib` Root:Debian:12	before 5.2.1-2.5+deb12u1.aikido.8	5.2.1-2.5+deb12u1.aikido.8
`rootio-giflib` Root:Debian:12	before 5.2.1-2.5+deb12u1.aikido.8	5.2.1-2.5+deb12u1.aikido.8
`giflib` SUSE:Linux Enterprise Server 12 SP5-LTSS	before 5.0.5-13.9.1	5.0.5-13.9.1
`giflib` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 5.0.5-13.9.1	5.0.5-13.9.1
`giflib` SUSE:Linux Enterprise Module for Basesystem 15 SP6	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise Server 15 SP3-LTSS	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise Server 15 SP4-LTSS	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Manager Proxy 4.3	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Manager Server 4.3	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` SUSE:Enterprise Storage 7.1	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1
`giflib` openSUSE:Leap 15.6	before 5.2.2-150000.4.16.1	5.2.2-150000.4.16.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-31344 is a high vulnerability (CVSS 7.3) in Giflib, published April 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in giflib 5.2.2-r1.

References

Show 25 moreShow less