CVE-2026-3707

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3707", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-07T09:09:50.930Z", "datePublished": "2026-03-08T05:02:15.404Z", "dateUpdated": "2026-03-10T14:09:23.158Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T05:02:15.404Z"}, "title": "MrNanko webp4j gif_decoder.c DecodeGifFromMemory integer overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "Integer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-189", "lang": "en", "description": "Numeric Error"}]}], "affected": [{"vendor": "MrNanko", "product": "webp4j", "versions": [{"version": "1.0", "status": "affected"}, {"version": "1.1", "status": "affected"}, {"version": "1.2", "status": "affected"}, {"version": "1.3", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in MrNanko webp4j up to 1.3.x. The affected element is the function DecodeGifFromMemory of the file src/main/c/gif_decoder.c. Such manipulation of the argument canvas_height leads to integer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 89771b201c66d15d29e4cc016d8aae82b6a5fbe1. It is advisable to implement a patch to correct this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-07T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-07T10:14:55.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "sp1d3r (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.349653", "name": "VDB-349653 | MrNanko webp4j gif_decoder.c DecodeGifFromMemory integer overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349653", "name": "VDB-349653 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.765972", "name": "Submit #765972 | MrNanko(dev.matrixlab:webp4j) webp4j <= 1.4.0 Integer Overflow to Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/MrNanko/webp4j/issues/6", "tags": ["issue-tracking"]}, {"url": "https://github.com/MrNanko/webp4j/issues/6#issuecomment-3941945014", "tags": ["issue-tracking"]}, {"url": "https://github.com/Sp1d3rL1/Webp4j-Heap-Buffer-Overflow/blob/main/README.EN.md", "tags": ["exploit"]}, {"url": "https://github.com/MrNanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1", "tags": ["patch"]}, {"url": "https://github.com/MrNanko/webp4j/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:09:03.400898Z", "id": "CVE-2026-3707", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:09:23.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3707", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:09:03.400898Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:09:19.378Z"}}], "cna": {"tags": ["x_open-source"], "title": "MrNanko webp4j gif_decoder.c DecodeGifFromMemory integer overflow", "credits": [{"lang": "en", "type": "reporter", "value": "sp1d3r (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "MrNanko", "product": "webp4j", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "1.2"}, {"status": "affected", "version": "1.3"}]}], "timeline": [{"lang": "en", "time": "2026-03-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-07T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-07T10:14:55.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.349653", "name": "VDB-349653 | MrNanko webp4j gif_decoder.c DecodeGifFromMemory integer overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349653", "name": "VDB-349653 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.765972", "name": "Submit #765972 | MrNanko(dev.matrixlab:webp4j) webp4j <= 1.4.0 Integer Overflow to Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/MrNanko/webp4j/issues/6", "tags": ["issue-tracking"]}, {"url": "https://github.com/MrNanko/webp4j/issues/6#issuecomment-3941945014", "tags": ["issue-tracking"]}, {"url": "https://github.com/Sp1d3rL1/Webp4j-Heap-Buffer-Overflow/blob/main/README.EN.md", "tags": ["exploit"]}, {"url": "https://github.com/MrNanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1", "tags": ["patch"]}, {"url": "https://github.com/MrNanko/webp4j/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in MrNanko webp4j up to 1.3.x. The affected element is the function DecodeGifFromMemory of the file src/main/c/gif_decoder.c. Such manipulation of the argument canvas_height leads to integer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 89771b201c66d15d29e4cc016d8aae82b6a5fbe1. It is advisable to implement a patch to correct this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-189", "description": "Numeric Error"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T05:02:15.404Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3707", "state": "PUBLISHED", "dateUpdated": "2026-03-10T14:09:23.158Z", "dateReserved": "2026-03-07T09:09:50.930Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-08T05:02:15.404Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "webp4j", "vendor": "MrNanko", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "1.2"}, {"status": "affected", "version": "1.3"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in MrNanko webp4j up to 1.3.x. The affected element is the function DecodeGifFromMemory of the file src/main/c/gif_decoder.c. Such manipulation of the argument canvas_height leads to integer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 89771b201c66d15d29e4cc016d8aae82b6a5fbe1. It is advisable to implement a patch to correct this issue."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en MrNanko webp4j hasta 1.3.x. El elemento afectado es la funci\u00f3n DecodeGifFromMemory del archivo src/main/c/gif_decoder.c. Dicha manipulaci\u00f3n del argumento canvas_height conduce a desbordamiento de entero. Se requiere acceso local para realizar este ataque. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El nombre del parche es 89771b201c66d15d29e4cc016d8aae82b6a5fbe1. Es aconsejable implementar un parche para corregir este problema."}], "id": "CVE-2026-3707", "lastModified": "2026-06-17T10:44:02.890", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3707", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T14:09:03.400898Z", "version": "2.0.3"}}]}, "published": "2026-03-08T05:16:32.193", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/MrNanko/webp4j/"}, {"source": "cna@vuldb.com", "url": "https://github.com/MrNanko/webp4j/commit/89771b201c66d15d29e4cc016d8aae82b6a5fbe1"}, {"source": "cna@vuldb.com", "url": "https://github.com/MrNanko/webp4j/issues/6"}, {"source": "cna@vuldb.com", "url": "https://github.com/MrNanko/webp4j/issues/6#issuecomment-3941945014"}, {"source": "cna@vuldb.com", "url": "https://github.com/Sp1d3rL1/Webp4j-Heap-Buffer-Overflow/blob/main/README.EN.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.349653"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.349653"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.765972"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-189"}, {"lang": "en", "value": "CWE-190"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "webp4j", "source": "cna", "vendor": "MrNanko"}, "product": "webp4j", "vendor": "mrnanko"}], "analysis": {"en": {"generated_at": "2026-04-18T17:26:58.580697+00:00", "value": {"mitigation_remediation": ["Apply the upstream patch corresponding to commit 89771b201c66d15d29e4cc016d8aae82b6a5fbe1 or upgrade to a later webp4j release that includes the integer overflow fix.", "If the application accepts GIFs from untrusted sources, execute the webp4j decoding process in a sandbox or under a least\u2011privileged user to contain any potential memory corruption.", "As a temporary measure, configure the application to reject GIF images whose canvas_height values exceed reasonable bounds or disable GIF decoding entirely until the patch is applied."], "summary": {"action": "Patch", "impact": "Integer overflow (memory corruption)"}, "threat_synthesis": {"affected_systems": "MrNanko webp4j versions up to 1.3.x are affected. The flaw exists in the gif_decoder.c source file used when the library decodes GIF images in applications that embed webp4j. Any system that incorporates these versions without the recent patch is potentially vulnerable.", "description_and_impact": "The vulnerability lies in the DecodeGifFromMemory function of the webp4j library. Manipulating the canvas_height argument can trigger an integer overflow. The overflow could lead to memory corruption, which is inferred from the nature of integer overflow vulnerabilities and not explicitly detailed in the CVE text.", "risk_and_exploitability": "The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not cataloged in the CISA KEV. Exploitation requires local access; an attacker must supply a crafted GIF file to the vulnerable application. Because a public exploit is available, systems running the affected library should apply the patch urgently to prevent possible memory corruption."}}}}, "created": "2026-03-09T10:03:33.872151+00:00", "updated": "2026-04-18T17:30:05.956626+00:00", "vendors": ["mrnanko", "mrnanko$PRODUCT$webp4j"]}