A GIF global color table is the file-wide palette used by image frames that do not define their own local color table. Instead of storing full RGB values for every pixel, many GIF images store pixel indices. Each index points into a table of RGB color entries near the start of the file.

In the GIF format, the global color table appears after the header and logical screen descriptor when the global color table flag is set. Each table entry is three bytes:

red, green, blue

The table size is always a power of two, from 2 to 256 entries. Pixels in image data then reference these entries by index.

As a steganography attack vector, the global color table can hide bytes in palette entries without visibly changing the image. This is especially useful when some palette entries are unused, rarely used, or visually close enough that small RGB changes are hard to notice.

Common hiding methods include:

• Storing payload bytes directly in unused RGB entries.
• Encoding bits in the least significant bits of palette colors.
• Reordering equivalent or unused palette entries to encode data.
• Hiding data after the required palette size when parsers or tools are lax.

Common Checks

• Inspect the logical screen descriptor and confirm whether a global color table is present.
• Calculate the expected table size from the packed field.
• Compare palette entries against the pixels that actually reference them.
• Look for unused entries, strange color values, or repeated colors with tiny differences.
• Extract the least significant bits from RGB values and test for readable data.