Vulnerabilities

TI-2026-29584 CVE-2026-40930

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

LOW 24

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00202 Published 2026-06-04 Partial fix CWE-436

TI-2026-27001 CVE-2026-34757

Use after free in pnggroup libpng

MEDIUM 56

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00199 Published 2026-04-09 Partial fix · 1.6.57 CWE-416

TI-2026-26017 CVE-2026-33636

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

LOW 35

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00751 Published 2026-03-26 Partial fix · 1.6.56 CWE-125

TI-2026-25813 CVE-2026-33416

LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

LOW 37

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01071 Published 2026-03-26 Partial fix · 1.6.56 CWE-416

TI-2026-03204 CVE-2026-3713 · GHSA-fgc7-hpwc-cmc9

pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow

MEDIUM 55

A flaw has been found in pnggroup libpng up to 1.6.55.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00147 Published 2026-03-08 Fixed CWE-119

TI-2026-20746 CVE-2026-25646

LIBPNG has a heap buffer overflow in png_set_quantize

HIGH 69

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.0112 Published 2026-02-10 Partial fix · 1.6.55 CWE-122

TI-2025-20736 CVE-2025-28164 · GHSA-gjxw-mrg7-952f

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a…

MEDIUM 58

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00165 Published 2026-01-27 Partial fix CWE-120

TI-2025-20735 CVE-2025-28162 · GHSA-h77p-hrmm-5v85

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a…

MEDIUM 58

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00166 Published 2026-01-27 Fixed CWE-120

TI-2026-18319 CVE-2026-22801

LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*

LOW 33

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00134 Published 2026-01-12 Partial fix · 1.6.54 CWE-125

TI-2026-18222 CVE-2026-22695

LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)

LOW 31

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00222 Published 2026-01-12 Partial fix · 1.6.54 CWE-125

TI-2025-40767 CVE-2025-66293

LIBPNG has an out-of-bounds read in png_image_read_composite

MEDIUM 64

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0038 Published 2025-12-03 Partial fix · 1.6.52 CWE-125

TI-2025-40204 CVE-2025-65018

LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

HIGH 66

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00278 Published 2025-11-24 Partial fix · 1.6.51 CWE-122

TI-2025-40066 CVE-2025-64720

LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

MEDIUM 64

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00447 Published 2025-11-24 Partial fix · 1.6.51 CWE-125

TI-2025-39898 CVE-2025-64506

LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images

LOW 26

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.0015 Published 2025-11-24 Partial fix · 1.6.51 CWE-125

TI-2025-39897 CVE-2025-64505

LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index

LOW 27

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00205 Published 2025-11-24 Partial fix · 1.6.51 CWE-125

TI-2021-03079 CVE-2021-4214 · GHSA-v3c8-fhq3-xvvh

Buffer overflow in libpng

LOW 26

A heap overflow flaw was found in libpngs' pngimage.c program.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00542 Published 2022-08-24 No fix listed CWE-120

TI-2020-18032 CVE-2020-35511 · GHSA-4p54-36pq-7qrc

Memory corruption in pngcheck

LOW 34

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00359 Published 2022-08-23 No fix listed CWE-126

TI-2020-16889 CVE-2020-27818 · GHSA-xjm9-9gr6-gcpx

Buffer overflow in pngcheck

LOW 18

A flaw was found in the check_chunk_name() function of pngcheck-2.4.0.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.01218 Published 2020-12-08 No fix listed CWE-120

TI-2017-09377 CVE-2017-12652 · GHSA-94xg-qm4r-9r7c

libpng before 1.6.32 does not properly check the length of chunks against the user limit.

MEDIUM 56

libpng before 1.6.32 does not properly check the length of chunks against the user limit.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04113 Published 2019-07-10 Partial fix CWE-20

TI-2018-10430 CVE-2018-14550 · GHSA-qwwr-qc2p-6283

An issue has been found in third-party PNM decoding associated with libpng 1.6.35.

MEDIUM 44

An issue has been found in third-party PNM decoding associated with libpng 1.6.35.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03541 Published 2019-07-10 Fixed in 1.6.37 CWE-787

TI-2019-05205 CVE-2019-7317 · GHSA-m96g-x499-p5f9

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because…

LOW 36

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.09393 Published 2019-02-04 Partial fix CWE-416

TI-2019-04339 CVE-2019-6129 · GHSA-rrr4-g4q4-hgr3

png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by…

LOW 32

png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01595 Published 2019-01-11 No fix listed CWE-401

TI-2018-10153 CVE-2018-14048 · GHSA-64xj-5wfx-5pjg

An issue has been found in libpng 1.6.34.

LOW 35

An issue has been found in libpng 1.6.34.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.03212 Published 2018-07-13 No fix listed

TI-2018-09999 CVE-2018-13785 · GHSA-fj59-ccrm-8h5w

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length…

LOW 36

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denia…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.04378 Published 2018-07-09 Partial fix CWE-190

TI-2016-08167 CVE-2016-10087 · GHSA-r346-8vrh-m3wr

The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x…

MEDIUM 41

The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vect…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.05131 Published 2017-01-30 Will not fix CWE-476

Vulnerabilities

Filters