Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and…
Priority MEDIUM 47CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04053 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | up to 10.11.3 | Vulnerable | Apple |
| cpe:2.3:a:libpng:libpng:*:beta:*:*:*:*:*:* | up to 1.5.20 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.0:*:*:*:*:*:*:* | 1.6.0 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.0:beta:*:*:*:*:*:* | 1.6.0 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.1:*:*:*:*:*:*:* | 1.6.1 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.1:beta:*:*:*:*:*:* | 1.6.1 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.2:*:*:*:*:*:*:* | 1.6.2 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.2:beta:*:*:*:*:*:* | 1.6.2 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.3:*:*:*:*:*:*:* | 1.6.3 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.3:beta:*:*:*:*:*:* | 1.6.3 beta | Vulnerable | pnggroup |
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions up to 10.11.3 Vulnerable ·Apple
- cpe:2.3:a:libpng:libpng:*:beta:*:*:*:*:*:* Versions up to 1.5.20 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.0:beta:*:*:*:*:*:* Versions 1.6.0 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.1:beta:*:*:*:*:*:* Versions 1.6.1 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.2:beta:*:*:*:*:*:* Versions 1.6.2 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.3:beta:*:*:*:*:*:* Versions 1.6.3 beta Vulnerable ·pnggroup
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libpng:libpng:1.6.4:*:*:*:*:*:*:* | 1.6.4 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.4:beta:*:*:*:*:*:* | 1.6.4 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.5:*:*:*:*:*:*:* | 1.6.5 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.6:*:*:*:*:*:*:* | 1.6.6 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.7:*:*:*:*:*:*:* | 1.6.7 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.7:beta:*:*:*:*:*:* | 1.6.7 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.8:*:*:*:*:*:*:* | 1.6.8 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.8:beta:*:*:*:*:*:* | 1.6.8 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.9:*:*:*:*:*:*:* | 1.6.9 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.9:beta:*:*:*:*:*:* | 1.6.9 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.10:*:*:*:*:*:*:* | 1.6.10 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.10:beta:*:*:*:*:*:* | 1.6.10 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.11:*:*:*:*:*:*:* | 1.6.11 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.11:beta:*:*:*:*:*:* | 1.6.11 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.12:beta:*:*:*:*:*:* | 1.6.12 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.13:*:*:*:*:*:*:* | 1.6.13 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.13:beta:*:*:*:*:*:* | 1.6.13 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.14:*:*:*:*:*:*:* | 1.6.14 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.14:beta:*:*:*:*:*:* | 1.6.14 beta | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.15:*:*:*:*:*:*:* | 1.6.15 | Vulnerable | pnggroup |
| cpe:2.3:a:libpng:libpng:1.6.15:beta:*:*:*:*:*:* | 1.6.15 beta | Vulnerable | pnggroup |
- cpe:2.3:a:libpng:libpng:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.4:beta:*:*:*:*:*:* Versions 1.6.4 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.7:beta:*:*:*:*:*:* Versions 1.6.7 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.8:beta:*:*:*:*:*:* Versions 1.6.8 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.9:*:*:*:*:*:*:* Versions 1.6.9 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.9:beta:*:*:*:*:*:* Versions 1.6.9 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.10:*:*:*:*:*:*:* Versions 1.6.10 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.10:beta:*:*:*:*:*:* Versions 1.6.10 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.11:*:*:*:*:*:*:* Versions 1.6.11 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.11:beta:*:*:*:*:*:* Versions 1.6.11 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.12:beta:*:*:*:*:*:* Versions 1.6.12 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.13:*:*:*:*:*:*:* Versions 1.6.13 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.13:beta:*:*:*:*:*:* Versions 1.6.13 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.14:*:*:*:*:*:*:* Versions 1.6.14 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.14:beta:*:*:*:*:*:* Versions 1.6.14 beta Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.15:*:*:*:*:*:*:* Versions 1.6.15 Vulnerable ·pnggroup
- cpe:2.3:a:libpng:libpng:1.6.15:beta:*:*:*:*:*:* Versions 1.6.15 beta Vulnerable ·pnggroup
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2014-9495
- 2026-10-03 Alias added: GHSA-wpr3-pfv2-chjq
References
Other 6
- [oss-security] 20150103 Re: CVE Request: libpng 1.6.15 Heap Overflow
- [png-mng-announce] 20141222 libpng-1.5.21 and 1.6.16 are available
- [oss-security] 20150109 Re: CVE Request: libpng 1.6.15 Heap Overflow
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- [oss-security] 20150110 Re: CVE Request: libpng 1.6.15 Heap Overflow
- [png-mng-implement] 20141221 Re: libpng-1.5.21rc02 and 1.6.16rc02 are available
Sources
- CVE-2014-9495 · CVE Program
- CVE-2014-9495 · NVD
- FIRST EPSS
- GHSA-wpr3-pfv2-chjq · GitHub Advisory Database · CC BY 4.0
- CVE-2014-9495 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences