CVE-2017-1000421

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function...

9.8 CriticalFix available

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.69%Up 1.2 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

Record: CVE-2017-1000421
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

Record: CVE-2017-1000421
Updated: 2026-11-02

EUVDEUVD-2017-1558 No score

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

Record: EUVD-2017-1558
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vp7h-g9mh-c77g 9.8

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function...

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

Record: GHSA-vp7h-g9mh-c77g
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 9.8

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

Record: CVE-2017-1000421
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-1000421 9.8

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

Record: DEBIAN-CVE-2017-1000421
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-1000421 9.8

Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

Record: UBUNTU-CVE-2017-1000421
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2018-0086 No score

Updated gifsicle package fixes security vulnerability

It was discovered that gifsicle contained a flaw that could lead to arbitrary code execution (CVE-2017-1000421).

Record: MGASA-2018-0086
Updated: 2026-11-02

OSVUSN-4803-1 No score

gifsicle vulnerabilities

It was discovered that Gifsicle did not properly handle certain input. If a user were tricked into opening a malicious GIF, an attacker could potentially execute arbitrary code.

Record: USN-4803-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`gifsicle` Debian:12	before 1.90-1	1.90-1
`gifsicle` Debian:13	before 1.90-1	1.90-1
`gifsicle` Debian:14	before 1.90-1	1.90-1
`gifsicle` Debian:7	before 1.67-1.1~deb7u1, plus listed versions 1.67-1	1.67-1.1~deb7u1
`gifsicle` Debian:8	before 1.86-1+deb8u1, plus listed versions 1.86-1	1.86-1+deb8u1
`gifsicle` Debian:9	before 1.88-3+deb9u1, plus listed versions 1.88-31.88-3+deb9u1~bpo8+1	1.88-3+deb9u1
`gifsicle` Mageia:6	before 1.88-1.1.mga6	1.88-1.1.mga6
`gifsicle` Ubuntu:Pro:14.04:LTS	before 1.78-1ubuntu0.1~esm1, plus listed versions 1.71-11.76-11.77-11.78-1	1.78-1ubuntu0.1~esm1
`gifsicle` Ubuntu:Pro:16.04:LTS	before 1.88-1ubuntu0.1~esm1, plus listed versions 1.88-1	1.88-1ubuntu0.1~esm1
`gifsicle` Ubuntu:Pro:14.04:LTS From an advisory covering 2 CVEs	before 1.78-1ubuntu0.1~esm1, plus listed versions 1.71-11.76-11.77-11.78-1	1.78-1ubuntu0.1~esm1
`gifsicle` Ubuntu:Pro:16.04:LTS From an advisory covering 2 CVEs	before 1.88-1ubuntu0.1~esm1, plus listed versions 1.88-1	1.88-1ubuntu0.1~esm1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1000421 is a critical vulnerability (CVSS 9.8) in Lcdf Gifsicle, published January 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.69%, the 85th percentile. Fixed in gifsicle 1.90-1.

References

Show 7 moreShow less