CVE-2026-3707 MrNanko webp4j gif_decoder.c DecodeGifFromMemory integer overflow
An integer overflow in webp4j's GIF decoder allows local attackers to cause a denial of service via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3707?
CVE-2026-3707 is a medium-severity vulnerability in MrNanko webp4j, published on 8 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was identified in MrNanko webp4j up to 1.3.x. The affected element is the function DecodeGifFromMemory of the file src/main/c/gif_decoder.c. Such manipulation of the argument canvas_height leads to integer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 89771b201c66d15d29e4cc016d8aae82b6a5fbe1. It is advisable to implement a patch to correct this issue.
Which versions are affected by CVE-2026-3707?
How do I fix CVE-2026-3707?
No fix has been published for CVE-2026-3707 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-3707 being exploited?
There is no known exploitation of CVE-2026-3707 in the wild and no public exploit code.
Sources
Also known as GHSA-vhg7-ppx8-v8hh.