Read the docs
TI-2015-00888 Aliases CVE-2015-0973GHSA-5gg5-9r5r-wpgh

Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21…

Priority MEDIUM 47CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0414 90th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*11.2VulnerableOracle
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*up to 1.5.20Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.0:*:*:*:*:*:*:*1.6.0Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.0:beta:*:*:*:*:*:*1.6.0 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.1:*:*:*:*:*:*:*1.6.1Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.1:beta:*:*:*:*:*:*1.6.1 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.2:*:*:*:*:*:*:*1.6.2Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.2:beta:*:*:*:*:*:*1.6.2 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.3:*:*:*:*:*:*:*1.6.3Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.3:beta:*:*:*:*:*:*1.6.3 betaVulnerablepnggroup
  • cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:* Versions 11.2 Vulnerable ·Oracle
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions up to 1.5.20 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.0:beta:*:*:*:*:*:* Versions 1.6.0 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.1:beta:*:*:*:*:*:* Versions 1.6.1 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.2:beta:*:*:*:*:*:* Versions 1.6.2 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.3:beta:*:*:*:*:*:* Versions 1.6.3 beta Vulnerable ·pnggroup
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:1.6.4:*:*:*:*:*:*:*1.6.4Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.4:beta:*:*:*:*:*:*1.6.4 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.5:*:*:*:*:*:*:*1.6.5Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.6:*:*:*:*:*:*:*1.6.6Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.7:*:*:*:*:*:*:*1.6.7Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.7:beta:*:*:*:*:*:*1.6.7 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.8:*:*:*:*:*:*:*1.6.8Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.8:beta:*:*:*:*:*:*1.6.8 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.9:*:*:*:*:*:*:*1.6.9Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.9:beta:*:*:*:*:*:*1.6.9 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.10:*:*:*:*:*:*:*1.6.10Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.10:beta:*:*:*:*:*:*1.6.10 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.11:*:*:*:*:*:*:*1.6.11Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.11:beta:*:*:*:*:*:*1.6.11 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.12:beta:*:*:*:*:*:*1.6.12 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.13:*:*:*:*:*:*:*1.6.13Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.13:beta:*:*:*:*:*:*1.6.13 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.14:*:*:*:*:*:*:*1.6.14Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.14:beta:*:*:*:*:*:*1.6.14 betaVulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.15:*:*:*:*:*:*:*1.6.15Vulnerablepnggroup
cpe:2.3:a:libpng:libpng:1.6.15:beta:*:*:*:*:*:*1.6.15 betaVulnerablepnggroup
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*up to 10.11.3VulnerableApple
  • cpe:2.3:a:libpng:libpng:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.4:beta:*:*:*:*:*:* Versions 1.6.4 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.7:beta:*:*:*:*:*:* Versions 1.6.7 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.8:beta:*:*:*:*:*:* Versions 1.6.8 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.9:*:*:*:*:*:*:* Versions 1.6.9 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.9:beta:*:*:*:*:*:* Versions 1.6.9 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.10:*:*:*:*:*:*:* Versions 1.6.10 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.10:beta:*:*:*:*:*:* Versions 1.6.10 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.11:*:*:*:*:*:*:* Versions 1.6.11 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.11:beta:*:*:*:*:*:* Versions 1.6.11 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.12:beta:*:*:*:*:*:* Versions 1.6.12 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.13:*:*:*:*:*:*:* Versions 1.6.13 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.13:beta:*:*:*:*:*:* Versions 1.6.13 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.14:*:*:*:*:*:*:* Versions 1.6.14 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.14:beta:*:*:*:*:*:* Versions 1.6.14 beta Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.15:*:*:*:*:*:*:* Versions 1.6.15 Vulnerable ·pnggroup
  • cpe:2.3:a:libpng:libpng:1.6.15:beta:*:*:*:*:*:* Versions 1.6.15 beta Vulnerable ·pnggroup
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions up to 10.11.3 Vulnerable ·Apple

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-0973
  2. 2026-10-03 Alias added: GHSA-5gg5-9r5r-wpgh

References

Exploit 3

Advisory 4

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences