{"id":"CVE-2026-3707","summary":"MrNanko webp4j gif_decoder.c DecodeGifFromMemory integer overflow","details":"A vulnerability was identified in MrNanko webp4j up to 1.3.x. The affected element is the function DecodeGifFromMemory of the file src/main/c/gif_decoder.c. Such manipulation of the argument canvas_height leads to integer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 89771b201c66d15d29e4cc016d8aae82b6a5fbe1. It is advisable to implement a patch to correct this issue.","modified":"2026-08-12T16:23:53.953911Z","published":"2026-03-08T05:02:15.404Z","database_specific":{"cwe_ids":["CWE-189","CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3707.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.0"},{"last_affected":"1.0"},{"introduced":"1.1"},{"last_affected":"1.1"},{"introduced":"1.2"},{"last_affected":"1.2"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB"},"references":[{"type":"WEB","url":"https://github.com/MrNanko/webp4j/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3707.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3707"},{"type":"ADVISORY","url":"https://vuldb.com/?id.349653"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.765972"},{"type":"REPORT","url":"https://github.com/MrNanko/webp4j/issues/6"},{"type":"REPORT","url":"https://github.com/MrNanko/webp4j/issues/6#issuecomment-3941945014"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.349653"},{"type":"FIX","url":"https://github.com/MrNanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1"},{"type":"EVIDENCE","url":"https://github.com/Sp1d3rL1/Webp4j-Heap-Buffer-Overflow/blob/main/README.EN.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mrnanko/webp4j","events":[{"introduced":"bf7b162be1cf28fa8a2a694e4e3029f820817a9e"},{"fixed":"89771b201c66d15d29e4cc016d8aae82b6a5fbe1"}],"database_specific":{"extracted_events":[{"introduced":"1.3"},{"last_affected":"1.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.3","v2.1.0","v2.0.0","v1.4.0","v1.3.1","v1.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3707.json","vanir_signatures_modified":"2026-08-12T16:23:53Z","vanir_signatures":[{"id":"CVE-2026-3707-04ddc3ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/mrnanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1","target":{"file":"src/main/c/gif_decoder.c","function":"DecodeGifFromMemory"},"deprecated":false,"digest":{"function_hash":"42668446530414014938816166552593643864","length":4104}},{"deprecated":false,"digest":{"function_hash":"227948982794060938254518298605819358529","length":363},"id":"CVE-2026-3707-280da4db","signature_type":"Function","signature_version":"v1","source":"https://github.com/mrnanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1","target":{"file":"src/main/java/dev/matrixlab/webp4j/internal/NativeLibraryLoader.java","function":"normalizeArchitecture"}},{"source":"https://github.com/mrnanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1","target":{"file":"src/main/c/gif_decoder.c","function":"CopyCanvas"},"deprecated":false,"digest":{"function_hash":"188570849418308541548926808375914279532","length":142},"id":"CVE-2026-3707-71638b4b","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mrnanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1","target":{"function":"loadLibrary","file":"src/main/java/dev/matrixlab/webp4j/internal/NativeLibraryLoader.java"},"deprecated":false,"digest":{"function_hash":"158508242893492129178145536851134571856","length":1159},"id":"CVE-2026-3707-7bae24e2"},{"target":{"file":"src/main/c/gif_decoder.c"},"deprecated":false,"digest":{"line_hashes":["106198690454698231076202098175294652199","192527245316786544260147551488870778891","136096154756812870125689452892739812891","334267714788691926786539440264157009362","1025933495338715107924628573225367975","110792717938310482361330294522106541865","109997788787214152966558607096792120391","124849187971867056264068906539095900162","89648940020955920104318862273799735240","273845666751439692845276152021673256519","158778727141320049609649334215327272218","60300563069387853021349463355307115337","150864708495582598224417437925875396343","94805813205207501816124469381415655661","317952007023857935541696059138388079564","262979034962008285584708119311429555208","56125373973218130269362266436100547849","278307784930818331076305194211520872074","252806368523490589886804600850849272852","274418206198208305455597426271191213516","120064232608047806589210741890627174704","273607465626294802593432821102418166034","150864708495582598224417437925875396343","94805813205207501816124469381415655661","317952007023857935541696059138388079564","262979034962008285584708119311429555208","56125373973218130269362266436100547849","278307784930818331076305194211520872074"],"threshold":0.9},"id":"CVE-2026-3707-a8c65910","signature_type":"Line","signature_version":"v1","source":"https://github.com/mrnanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1"},{"source":"https://github.com/mrnanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1","target":{"file":"src/main/java/dev/matrixlab/webp4j/internal/NativeLibraryLoader.java"},"deprecated":false,"digest":{"line_hashes":["208754797056877622746327647649263757921","109600497523256959754973286716062977676","5644586150270252034169382084367440062","100847207988383666965474142631062968799","95092278483954945400982476180310313320","329964101887342415006564091917590815583","325023363606797553053555761102678027308","62092307445720347380637447089850832535","318626468290726914870541034624309364507","262550149661610941308009083456228662283","160914299178277232804233619890003780955","217882878299209331658842558817725941951","202129281971586960572398448102947248844"],"threshold":0.9},"id":"CVE-2026-3707-b801100b","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mrnanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1","target":{"file":"src/main/c/gif_decoder.c","function":"ClearCanvas"},"deprecated":false,"digest":{"function_hash":"73824709701355064105577683088847427007","length":399},"id":"CVE-2026-3707-cccfeabe"},{"digest":{"length":1452,"function_hash":"102688856272025505960770107051843433760"},"id":"CVE-2026-3707-d25ec758","signature_type":"Function","signature_version":"v1","source":"https://github.com/mrnanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1","target":{"file":"src/main/c/gif_decoder.c","function":"GetGifInfo"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}