A critical buffer overflow in the bitbank2 AnimatedGIF library allows remote attackers to cause a crash or execute arbitrary code via malicious GIF files.

The vulnerability exists in the DecodeLZW function, which fails to properly handle bounds checking during GIF decompression. An attacker can supply a specially crafted GIF file that causes a buffer overflow, leading to application crashes or the execution of arbitrary code.

With a CVSS score of 9.8, this vulnerability is critical for any application utilizing this library to process image uploads or user-provided files. Successful exploitation could lead to full application compromise or service disruption, causing significant reputational and operational harm to businesses relying on the library for image processing.

Immediate Action: Update the bitbank2 AnimatedGIF library to the latest patched version.

Proactive Monitoring: Implement strict file type validation and scanning for all user-uploaded images before they reach the processing layer.

Compensating Controls: Run image processing tasks within a sandboxed, low-privilege container environment to limit the impact of a potential compromise.

Public Exploit Available: Unknown

Developers and security teams must audit their software supply chain to identify applications that depend on the bitbank2 AnimatedGIF library. Updating to the latest version is essential to mitigate the risk of remote code execution via malicious image files.