Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 58

Export CSV
CVE-2026-33416

LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Libpng Pnggroup
Products
Libpng Libpng
CVE-2026-33636

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Libpng Pnggroup
Products
Libpng Libpng
CVE-2025-28164

libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2025-28162

libpng: libpng: Denial of Service via buffer overflow in pngimage utility

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2025-66293

LIBPNG has an out-of-bounds read in png_image_read_composite

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2025-64720

LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2025-65018

LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2025-64506

LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2025-64505

LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2013-6954

libpng: unhandled zero-length PLTE chunk or NULL palette

The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE chunk of zero bytes or (2) a NULL palette, related to pngrtran.c and pngset.c.

CVSS 3.1 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Libpng Redhat
Products
Libpng Network Satellite Rhel Extras and 1 more
CVE-2015-0973

libpng: Heap-buffer overflow png_combine_row() with very wide interlaced images

Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Apple Libpng Oracle
Products
Mac Os X Libpng Solaris
CVE-2014-9495

libpng: buffer overflow in png_combine_row

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Apple Libpng
Products
Mac Os X Libpng
CVE-2013-7354

libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2013-7353

libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks()

Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2011-3045

libpng: buffer overflow in png_inflate caused by invalid type conversions

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 10 more
CVE-2016-10087

libpng: NULL pointer dereference in png_set_text_2()

The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2014-0333

libpng: denial of service via png_push_read_chunk()

The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2015-7981

libpng: Out-of-bounds read in png_convert_to_rfc1123

The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.

CVSS 2.0 · 5.0 Medium EPSS 6.4% KEV · Not listed
Vendors
Canonical Debian Libpng and 1 more
Products
Ubuntu Linux Debian Linux Libpng and 10 more
CVE-2015-8472

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.

CVSS 3.0 · 7.3 High EPSS 6.1% KEV · Not listed
Vendors
Apple Libpng Redhat
Products
Mac Os X Libpng Enterprise Linux and 3 more