CVE-2023-36193
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error...
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
- Record
CVE-2023-36193- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
- Record
CVE-2023-36193- Updated
- 2026-11-02
EUVDEUVD-2023-40170 No score
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
- Record
EUVD-2023-40170- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4f2r-gxmm-56p6
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error...
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
- Record
GHSA-4f2r-gxmm-56p6- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-36193
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
- Record
DEBIAN-CVE-2023-36193- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-36193
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
- Record
UBUNTU-CVE-2023-36193- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV No score
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.
- Record
CVE-2023-36193- Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0160-1 No score
Security update for gifsicle
This update for gifsicle fixes the following issues:
-
Update to version 1.94:
- Fix some bugs, including fix for CVE-2023-36193: heap buffer overflow (read) via the ambiguity_error component at /src/clp.c (boo#1212645).
- Record
openSUSE-SU-2023:0160-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13023-1 No score
gifsicle-1.94-1.1 on GA media
These are all security issues fixed in the gifsicle-1.94-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13023-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gifsicleDebian:12 |
All versions, plus listed versions 1.93-21.94-11.95-11.95-21.96-11.97-11.98-1 |
None known |
gifsicleDebian:13 |
before 1.94-1 | 1.94-1 |
gifsicleDebian:14 |
before 1.94-1 | 1.94-1 |
gifsicleUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.71-11.76-11.77-11.78-11.78-1ubuntu0.1~esm1 |
None known |
gifsicleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.88-11.88-1ubuntu0.1~esm1 |
None known |
gifsicleUbuntu:18.04:LTS |
All versions, plus listed versions 1.90-11.91-2 |
None known |
gifsicleUbuntu:20.04:LTS |
All versions, plus listed versions 1.92-2 |
None known |
gifsicleUbuntu:22.04:LTS |
All versions, plus listed versions 1.92-21.93-2 |
None known |
gifsicleUbuntu:24.04:LTS |
All versions, plus listed versions 1.94-1 |
None known |
gifsicleUbuntu:25.10 |
All versions, plus listed versions 1.95-21.96-1 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gifsicleUbuntu:26.10 |
All versions, plus listed versions 1.96-1build1 |
None known |
gifsicleUbuntu:26.04:LTS |
All versions, plus listed versions 1.96-11.96-1build1 |
None known |
gifsicleSUSE:Package Hub 15 SP4 |
before 1.94-bp155.3.3.1 | 1.94-bp155.3.3.1 |
gifsicleSUSE:Package Hub 15 SP5 |
before 1.94-bp155.3.3.1 | 1.94-bp155.3.3.1 |
gifsicleopenSUSE:Leap 15.4 |
before 1.94-bp155.3.3.1 | 1.94-bp155.3.3.1 |
gifsicleopenSUSE:Leap 15.5 |
before 1.94-bp155.3.3.1 | 1.94-bp155.3.3.1 |
gifsicleopenSUSE:Tumbleweed |
before 1.94-1.1 | 1.94-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36193 is a high vulnerability (CVSS 7.8) in Lcdf Gifsicle, published June 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in gifsicle 1.94-1.