CVE WatchJul 15, 2026

CVE-2026-23868

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The cond

CVSS

5.1

Medium

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Mar 10, 2026 · Last modified: Jul 15, 2026 · CWE-415 · CWE-825

EPSS · 30d

0.1%EPSS · 30 days0.2%

2026-10-022026-10-30

Technical description

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-119338—

—

——0Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4.16h CVE-2026-1191167.8 HIG

—

——0A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.17h CVE-2026-420577.5 HIG

20.3%

——6An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.19h CVE-2026-412167.5 HIG

20.3%

——6An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.19h CVE-2026-858908.8 HIG

48.0%

——14Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.19h CVE-2026-838318.8 HIG

55.5%

——17Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.2d