CVE-2021-45909

What it actually does

Heap-based buffer overflow in the DecodeLZW function permits writing arbitrary attacker-controlled data beyond allocated buffer boundaries, resulting in memory corruption and potential arbitrary code execution.

Why it matters to the business

Processing untrusted GIF images with the affected converter can lead to full system compromise on user workstations or build servers, enabling malware deployment or data theft with no vendor fixes available.

How an attack unfolds

An attacker creates a specially crafted GIF containing an oversized LZW stream that triggers the overflow during decoding; the victim opens or converts the file locally, allowing the overflow to corrupt heap structures and redirect execution to attacker-supplied code.

How to fix it

Immediately discontinue use of gif2apng 1.9; replace with alternative GIF conversion utilities or updated forks that have addressed the DecodeLZW bounds issue; isolate or remove the binary from all build and user environments.

How to confirm the fix worked

Confirm absence of the gif2apng 1.9 binary; run version checks across systems and CI pipelines; test conversion of known malformed GIF samples in isolated environments to verify no overflow occurs.

Typical attack path

1. Generate malicious GIF with oversized LZW data targeting DecodeLZW
2. Deliver file via email, web download, or archive
3. Victim invokes gif2apng on the file
4. Overflow occurs, enabling code execution or crash

How to detect it

Search process execution logs and EDR telemetry for gif2apng invocations on untrusted GIF files; inspect crash dumps or heap corruption indicators around LZW decoding routines; review file-access histories for recently converted suspicious images.

• gif2apng
• DecodeLZW

What your security team should do

• Inventory all instances of gif2apng and remove or replace them
• Block execution of the binary via application allow-listing
• Scan mail and file shares for GIFs that may trigger the flaw
• Monitor endpoint logs for gif2apng crashes or unexpected child processes