{"id":"CVE-2021-40633","aliases":["ALPINE-CVE-2021-40633","AZL-41515","BELL-CVE-2021-40633","CLSA-2026-1787646995","DEBIAN-CVE-2021-40633","EUVD-2021-27807","GHSA-77hm-q3fv-fq9x","JLSEC-2026-816","OESA-2024-1595","OESA-2024-1599","OESA-2024-1602","OESA-2024-1664","OESA-2024-1665","OESA-2024-1666","ROOT-OS-DEBIAN-12-CVE-2021-40633","SUSE-SU-2024:0786-1","SUSE-SU-2024:1622-1","UBUNTU-CVE-2021-40633","USN-6824-1","openSUSE-SU-2024:13723-1"],"status":"published","title":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote...","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01717,"percentile":0.77769,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2022-06-14T10:22:11Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"giflib","fixed_in":["5.2.1-10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"giflib","fixed_in":["5.2.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"giflib","fixed_in":["5.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"giflib","fixed_in":["5.2.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Giflib_jll","fixed_in":["5.2.1+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"giflib","fixed_in":["5.2.1-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"giflib","fixed_in":["5.2.1-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"giflib","fixed_in":["5.2.1-6.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"giflib","fixed_in":["5.2.1-8.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"giflib","fixed_in":["5.2.1-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"giflib","fixed_in":["5.2.1-8.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"giflib","fixed_in":["5.2.1-2.5+deb12u1.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-giflib","fixed_in":["5.2.1-2.5+deb12u1.aikido.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"giflib","fixed_in":["5.1.4-0.3~16.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"giflib","fixed_in":["5.1.4-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"giflib","fixed_in":["5.1.9-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"giflib","fixed_in":["5.1.9-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-r2"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-r5"},{"fixed":"5.2.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"giflib-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgif-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgif7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.1-2.5","5.2.1-2.5+deb12u1","5.2.2-1","6.1.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"Giflib_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.1+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-6.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-8.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-8.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-2.5+deb12u1.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-2.5+deb12u1.aikido.8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-150000.4.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-13.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-13.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-13.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-0.3~16.04.1+esm1"}]}],"versions":["4.1.6-11","5.1.1-0ubuntu1","5.1.1-0.1","5.1.1-0.2","5.1.2-0.1","5.1.2-0.2","5.1.4-0.3~16.04","5.1.4-0.3~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-2ubuntu0.1+esm1"}]}],"versions":["5.1.4-1","5.1.4-2","5.1.4-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.9-1ubuntu0.1"}]}],"versions":["5.1.4-3ubuntu1","5.1.9-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.9-2ubuntu0.1"}]}],"versions":["5.1.9-2build1","5.1.9-2build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-0.3~16.04.1+esm1"}]}],"versions":["4.1.6-11","5.1.1-0ubuntu1","5.1.1-0.1","5.1.1-0.2","5.1.2-0.1","5.1.2-0.2","5.1.4-0.3~16.04","5.1.4-0.3~16.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-2ubuntu0.1+esm1"}]}],"versions":["5.1.4-1","5.1.4-2","5.1.4-2ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.9-1ubuntu0.1"}]}],"versions":["5.1.4-3ubuntu1","5.1.9-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.9-2ubuntu0.1"}]}],"versions":["5.1.9-2build1","5.1.9-2build2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1.1"}]}],"bundled":3}],"products":[{"vendor":"giflib_project","product":"giflib"}],"references":[{"url":"https://sourceforge.net/p/giflib/bugs/157/","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40633","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-77hm-q3fv-fq9x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-40633","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-40633","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787646995.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-23922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23868","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-40633","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1595","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1599","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1602","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1664","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1665","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1666","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240786-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198880","tags":["report"]},{"url":"https://bugzilla.suse.com/1200551","tags":["report"]},{"url":"https://bugzilla.suse.com/1217390","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48161","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241622-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1094832","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11490","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-40633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40633","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6824-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-28506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39742","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15133","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-40633","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-14T10:22:11Z","modified":"2024-08-04T02:44:10.819Z","updated_at":"2026-11-02T14:33:01.495293Z"}],"euvd":[{"id":"EUVD-2021-27807","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-14T10:22:11Z","modified":"2024-08-04T02:44:10Z","updated_at":"2026-11-03T03:24:20.264881Z"}],"ghsa":[{"id":"GHSA-77hm-q3fv-fq9x","title":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote...","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-15T00:00:27Z","modified":"2023-01-27T05:04:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:42:31.020352Z"}],"nvd":[{"id":"CVE-2021-40633","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-14T11:15:10.47Z","modified":"2026-06-17T04:07:11.777Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:07:06.501652Z"}],"osv":[{"id":"ALPINE-CVE-2021-40633","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-14T11:15:10.47Z","modified":"2026-10-23T17:17:56.211377341Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-41515","title":"CVE-2021-40633 affecting package giflib for versions less than 5.2.1-10","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-14T11:15:10Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"BELL-CVE-2021-40633","status":"published","published":"2024-03-21T10:18:58.648341Z","modified":"2026-01-26T09:32:40.894307Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-40633","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-14T11:15:10.47Z","modified":"2026-03-14T11:10:41.917247Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-40633","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-14T11:15:10.47Z","modified":"2026-10-23T18:03:33.070480501Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"JLSEC-2026-816","description":"A memory leak (out-of-memory) in gif2rgb in `util/gif2rgb.c` in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2026-07-30T15:01:04.165Z","modified":"2026-07-30T15:15:05.015691194Z","cvss":[{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2024-1595","title":"giflib security update","description":"giflib is a library of gif images and provides utilities for processing images.\r\n\r\nSecurity Fix(es):\r\n\r\nA memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)","status":"published","published":"2024-05-17T11:07:03Z","modified":"2026-08-18T01:17:22.376779672Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1599","title":"giflib security update","description":"giflib is a library of gif images and provides utilities for processing images.\r\n\r\nSecurity Fix(es):\r\n\r\nA memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)","status":"published","published":"2024-05-17T11:07:03Z","modified":"2026-08-18T01:18:26.379353173Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1602","title":"giflib security update","description":"giflib is a library of gif images and provides utilities for processing images.\r\n\r\nSecurity Fix(es):\r\n\r\nA memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)","status":"published","published":"2024-05-17T11:07:03Z","modified":"2026-08-18T01:18:26.435469251Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1664","title":"giflib security update","description":"giflib is a library of gif images and provides utilities for processing images.\r\n\r\nSecurity Fix(es):\r\n\r\nA memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)","status":"published","published":"2024-05-24T11:07:07Z","modified":"2026-08-18T01:17:22.909259548Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1665","title":"giflib security update","description":"giflib is a library of gif images and provides utilities for processing images.\r\n\r\nSecurity Fix(es):\r\n\r\nA memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)","status":"published","published":"2024-05-24T11:07:07Z","modified":"2026-08-18T01:17:22.958115613Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1666","title":"giflib security update","description":"giflib is a library of gif images and provides utilities for processing images.\r\n\r\nSecurity Fix(es):\r\n\r\nA memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)","status":"published","published":"2024-05-24T11:07:07Z","modified":"2026-08-18T01:17:23.025166709Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2021-40633","description":"A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.","status":"published","published":"2022-06-14T11:15:00Z","modified":"2026-04-22T13:02:09.447347Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"CLSA-2026-1787646995","title":"Fix CVE(s): CVE-2020-23922, CVE-2021-40633, CVE-2026-23868","description":"   * SECURITY UPDATE: heap buffer over-read in gif2rgb\n     - debian/patches/CVE-2020-23922.patch: bound each pixel index against\n       the active color table before indexing ColorMap-\u003eColors in\n       DumpScreen2RGB in util/gif2rgb.c.\n     - CVE-2020-23922\n   * SECURITY UPDATE: memory leak leading to denial of service\n     - debian/patches/CVE-2021-40633.patch: free every ScreenBuffer row, not\n       just the row-pointer array, at the end of GIF2RGB in\n       util/gif2rgb.c.\n     - CVE-2021-40633\n   * SECURITY UPDATE: double free in GifMakeSavedImage\n     - debian/patches/CVE-2026-23868.patch: null out the heap pointers\n       aliased by the shallow copy of CopyFrom, test the source record when\n       deciding what to deep-copy, and restore ExtensionBlockCount after the\n       extension blocks are copied, in lib/gifalloc.c.\n     - CVE-2026-23868","status":"published","published":"2026-08-25T08:36:48Z","modified":"2026-10-26T09:30:42.804789392Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2024:13723-1","title":"giflib-devel-32bit-5.2.2-1.1 on GA media","description":"These are all security issues fixed in the giflib-devel-32bit-5.2.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:03:57.076805Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2021-40633","title":"CVE-2021-40633 in giflib - Patched by Root","description":"Root has patched CVE-2021-40633 in the giflib package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-27T12:28:51Z","modified":"2026-08-27T13:45:04.643944927Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-SU-2024:0786-1","title":"Security update for giflib","description":"This update for giflib fixes the following issues:\n\nUpdate to version 5.2.2\n\n* Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)\n* #138 Documentation for obsolete utilities still installed\n* #139: Typo in 'LZW image data' page ('110_2 = 4_10')\n* #140: Typo in 'LZW image data' page ('LWZ')\n* #141: Typo in 'Bits and bytes' page ('filed')\n* Note as already fixed SF issue #143: cannot compile under mingw\n* #144: giflib-5.2.1 cannot be build on windows and other platforms using c89\n* #145: Remove manual pages installation for binaries that are not installed too\n* #146: [PATCH] Limit installed man pages to binaries, move giflib to section 7\n* #147 [PATCH] Fixes to doc/whatsinagif/ content\n* #148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB\n* Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1\n* Declared Won't-fix on SF issue 149: Out of source builds no longer possible\n* #151: A heap-buffer-overflow in gif2rgb.c:294:45\n* #152: Fix some typos on the html documentation and man pages\n* #153: Fix segmentation faults due to non correct checking for args\n* #154: Recover the giffilter manual page\n* #155: Add gifsponge docs\n* #157: An OutofMemory-Exception or Memory Leak in gif2rgb\n* #158: There is a null pointer problem in gif2rgb\n* #159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45\n* #163: detected memory leaks in openbsd_reallocarray giflib/openbsd-reallocarray.c\n* #164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c\n* #166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c\n* #167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c\n","status":"published","published":"2024-03-06T20:07:22Z","modified":"2026-02-04T03:49:42.24352Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1622-1","title":"Security update for giflib","description":"This update for giflib fixes the following issues:\n\n- CVE-2018-11490: Fixed a heap-based buffer overflow in DGifDecompressLine() (bsc#1094832)\n- CVE-2021-40633: Fixed a denial of service from excessive memory (bsc#1200551)\n","status":"published","published":"2024-05-13T09:02:15Z","modified":"2025-05-02T04:29:52.043624Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6824-1","title":"giflib vulnerabilities","description":"It was discovered that GIFLIB incorrectly handled certain GIF files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2021-40633, CVE-2022-28506, CVE-2023-39742)\n","status":"published","published":"2024-06-10T14:27:14Z","modified":"2026-06-25T13:30:34.65562596Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}