In reviewing microsoft/vcpkg#53142 to add aui-framework to vcpkg, GPT 5.6 Sol flags that a vendored copy of https://github.com/lecram/gifdec is present in the sources here. https://github.com/lecram/gifdec has 4 year old filed probably exploitable memory corruption bugs e.g. lecram/gifdec#23
It's possible that there is no acceptable library under license terms aui-framework can use, but if that's the case there should probably be an explicit knob, build system or otherwise, to not include the problematic gif parser(s).
In reviewing microsoft/vcpkg#53142 to add aui-framework to vcpkg, GPT 5.6 Sol flags that a vendored copy of https://github.com/lecram/gifdec is present in the sources here. https://github.com/lecram/gifdec has 4 year old filed probably exploitable memory corruption bugs e.g. lecram/gifdec#23
It's possible that there is no acceptable library under license terms aui-framework can use, but if that's the case there should probably be an explicit knob, build system or otherwise, to not include the problematic gif parser(s).