Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34…
Priority LOW 26CWE-193Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-193 and the CVSS impact.
Summary
Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.
Why it matters now
EPSS 0.03343 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* | before 1.2.32 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta1:*:*:*:*:*:* | 1.4.0 beta1 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta10:*:*:*:*:*:* | 1.4.0 beta10 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta11:*:*:*:*:*:* | 1.4.0 beta11 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta12:*:*:*:*:*:* | 1.4.0 beta12 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta13:*:*:*:*:*:* | 1.4.0 beta13 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta14:*:*:*:*:*:* | 1.4.0 beta14 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta15:*:*:*:*:*:* | 1.4.0 beta15 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta16:*:*:*:*:*:* | 1.4.0 beta16 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta17:*:*:*:*:*:* | 1.4.0 beta17 | Vulnerable | pnggroup |
- cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions before 1.2.32 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta1:*:*:*:*:*:* Versions 1.4.0 beta1 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta10:*:*:*:*:*:* Versions 1.4.0 beta10 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta11:*:*:*:*:*:* Versions 1.4.0 beta11 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta12:*:*:*:*:*:* Versions 1.4.0 beta12 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta13:*:*:*:*:*:* Versions 1.4.0 beta13 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta14:*:*:*:*:*:* Versions 1.4.0 beta14 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta15:*:*:*:*:*:* Versions 1.4.0 beta15 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta16:*:*:*:*:*:* Versions 1.4.0 beta16 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta17:*:*:*:*:*:* Versions 1.4.0 beta17 Vulnerable ·pnggroup
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libpng:libpng:1.4.0:beta18:*:*:*:*:*:* | 1.4.0 beta18 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta19:*:*:*:*:*:* | 1.4.0 beta19 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta2:*:*:*:*:*:* | 1.4.0 beta2 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta20:*:*:*:*:*:* | 1.4.0 beta20 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta21:*:*:*:*:*:* | 1.4.0 beta21 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta22:*:*:*:*:*:* | 1.4.0 beta22 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta23:*:*:*:*:*:* | 1.4.0 beta23 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta24:*:*:*:*:*:* | 1.4.0 beta24 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta25:*:*:*:*:*:* | 1.4.0 beta25 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta26:*:*:*:*:*:* | 1.4.0 beta26 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta27:*:*:*:*:*:* | 1.4.0 beta27 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta28:*:*:*:*:*:* | 1.4.0 beta28 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta29:*:*:*:*:*:* | 1.4.0 beta29 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta3:*:*:*:*:*:* | 1.4.0 beta3 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta30:*:*:*:*:*:* | 1.4.0 beta30 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta31:*:*:*:*:*:* | 1.4.0 beta31 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta32:*:*:*:*:*:* | 1.4.0 beta32 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta33:*:*:*:*:*:* | 1.4.0 beta33 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta4:*:*:*:*:*:* | 1.4.0 beta4 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta5:*:*:*:*:*:* | 1.4.0 beta5 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta6:*:*:*:*:*:* | 1.4.0 beta6 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta7:*:*:*:*:*:* | 1.4.0 beta7 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta8:*:*:*:*:*:* | 1.4.0 beta8 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.4.0:beta9:*:*:*:*:*:* | 1.4.0 beta9 | Vulnerable | pnggroup |
- cpe:2.3:a:libpng:libpng:1.4.0:beta18:*:*:*:*:*:* Versions 1.4.0 beta18 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta19:*:*:*:*:*:* Versions 1.4.0 beta19 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta2:*:*:*:*:*:* Versions 1.4.0 beta2 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta20:*:*:*:*:*:* Versions 1.4.0 beta20 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta21:*:*:*:*:*:* Versions 1.4.0 beta21 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta22:*:*:*:*:*:* Versions 1.4.0 beta22 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta23:*:*:*:*:*:* Versions 1.4.0 beta23 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta24:*:*:*:*:*:* Versions 1.4.0 beta24 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta25:*:*:*:*:*:* Versions 1.4.0 beta25 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta26:*:*:*:*:*:* Versions 1.4.0 beta26 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta27:*:*:*:*:*:* Versions 1.4.0 beta27 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta28:*:*:*:*:*:* Versions 1.4.0 beta28 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta29:*:*:*:*:*:* Versions 1.4.0 beta29 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta3:*:*:*:*:*:* Versions 1.4.0 beta3 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta30:*:*:*:*:*:* Versions 1.4.0 beta30 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta31:*:*:*:*:*:* Versions 1.4.0 beta31 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta32:*:*:*:*:*:* Versions 1.4.0 beta32 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta33:*:*:*:*:*:* Versions 1.4.0 beta33 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta4:*:*:*:*:*:* Versions 1.4.0 beta4 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta5:*:*:*:*:*:* Versions 1.4.0 beta5 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta6:*:*:*:*:*:* Versions 1.4.0 beta6 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta7:*:*:*:*:*:* Versions 1.4.0 beta7 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta8:*:*:*:*:*:* Versions 1.4.0 beta8 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.4.0:beta9:*:*:*:*:*:* Versions 1.4.0 beta9 Vulnerable ·pnggroup
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2008-3964
- 2026-10-03 Alias added: GHSA-fj2p-r342-gx3m
References
Advisory 10
- http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=624517
- [oss-security] 20080909 CVE request (libpng)
- 1020521
- 259989
- [oss-security] 20080909 Re: CVE request (libpng)
- VU#889484
- GLSA-200812-15
- [png-mng-implement] 20080918 libpng-1.0.40 and libpng-1.2.32 available
- http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm
- MDVSA-2009:051
More pnggroup Libpng vulnerabilities
- TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
- TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
- TI-2026-20746 LIBPNG has a heap buffer overflow in png_set_quantize CVSS 4.0HIGH 8.3
- TI-2025-40204 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` CVSS 3.1HIGH 7.1
- TI-2025-40767 LIBPNG has an out-of-bounds read in png_image_read_composite CVSS 3.1HIGH 7.1
- TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
Sources
- CVE-2008-3964 · CVE Program
- CVE-2008-3964 · NVD
- FIRST EPSS
- GHSA-fj2p-r342-gx3m · GitHub Advisory Database · CC BY 4.0
- CVE-2008-3964 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences