Read the docs
TI-2026-29584 Aliases CVE-2026-40930

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

Priority LOW 24CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 1 fixed, 12 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnggrouplibpng= 1.8.0—No fix listedCNA
pnggrouplibpng-apng1.6.49 – 1.6.57—No fix listedCNA
  • libpng Vendorpnggroup Affected = 1.8.0 Fixed in — No fix listed CNA
  • libpng-apng Vendorpnggroup Affected 1.6.49 – 1.6.57 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*——pnggroup
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions — — ·pnggroup

Remediation

Red Hat 1 advisory

  • RHSA-2026:20356 Released 2026-05-23 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.58-1.hum1@aarch64, libpng-1.6.58-1.hum1@src, libpng-1.6.58-1.hum1@x86_64 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat build of OpenJDK 1.8AffectedNo fix yet: Fix deferred
Red Hat build of OpenJDK 11 ELSAffectedNo fix planned: Out of support scope
Red Hat build of OpenJDK 17AffectedNo fix yet: Fix deferred
Red Hat build of OpenJDK 21AffectedNo fix yet: Fix deferred
Red Hat build of OpenJDK 25AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:20356
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40930
  2. 2026-11-06 Affected versions changed · Red Hat

References

Other 2

  • TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
  • TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2026-20746 LIBPNG has a heap buffer overflow in png_set_quantize CVSS 4.0HIGH 8.3
  • TI-2025-40204 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` CVSS 3.1HIGH 7.1
  • TI-2025-40767 LIBPNG has an out-of-bounds read in png_image_read_composite CVSS 3.1HIGH 7.1
  • TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences