CVE-2020-28248

View on CVE.org

Published Feb 19, 2021 CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Description

An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:png-img_project:png-img:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2021-2566	An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.
Github GHSA	GHSA-q5wr-fvpq-p67g	Integer Overflow in png-img

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploit prediction score: 2.2% (2.244% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/gemini-testing/png-img
https://github.com/gemini-testing/png-img/commit/14ac462a32ca4b3b78f56502ac976d5b0222ce3d
https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0
https://securitylab.github.com/advisories/GHSL-2020-142-gemini-png-img

History

No history.

Subscriptions

Png-img Project Png-img

Weaknesses

Sources

CVE record Updated: Aug 4, 2024, 4:33 PM

Status: PUBLISHED
Assigner: mitre
Published: Feb 19, 2021, 11:05 PM
Updated: Aug 4, 2024, 4:33 PM
Reserved: Nov 6, 2020, 12:00 AM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Jun 17, 2026, 3:10 AM

Status: Modified
Published: Feb 20, 2021, 12:15 AM
Modified: Jun 17, 2026, 3:10 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-02-19T23:05:09.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/gemini-testing/png-img"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/gemini-testing/png-img/commit/14ac462a32ca4b3b78f56502ac976d5b0222ce3d"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0"}, {"tags": ["x_refsource_MISC"], "url": "https://securitylab.github.com/advisories/GHSL-2020-142-gemini-png-img"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-28248", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/gemini-testing/png-img", "refsource": "MISC", "url": "https://github.com/gemini-testing/png-img"}, {"name": "https://github.com/gemini-testing/png-img/commit/14ac462a32ca4b3b78f56502ac976d5b0222ce3d", "refsource": "MISC", "url": "https://github.com/gemini-testing/png-img/commit/14ac462a32ca4b3b78f56502ac976d5b0222ce3d"}, {"name": "https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0", "refsource": "MISC", "url": "https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0"}, {"name": "https://securitylab.github.com/advisories/GHSL-2020-142-gemini-png-img", "refsource": "MISC", "url": "https://securitylab.github.com/advisories/GHSL-2020-142-gemini-png-img"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T16:33:58.211Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/gemini-testing/png-img"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/gemini-testing/png-img/commit/14ac462a32ca4b3b78f56502ac976d5b0222ce3d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://securitylab.github.com/advisories/GHSL-2020-142-gemini-png-img"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-28248", "datePublished": "2021-02-19T23:05:09.000Z", "dateReserved": "2020-11-06T00:00:00.000Z", "dateUpdated": "2024-08-04T16:33:58.211Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:png-img_project:png-img:*:*:*:*:*:*:*:*", "matchCriteriaId": "433F356A-CB84-4159-866E-2837E32994C7", "versionEndExcluding": "3.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file."}, {"lang": "es", "value": "Un desbordamiento de enteros en la funci\u00f3n PngImg::InitStorage_ () de png-img versiones anteriores a 3.1.0, conlleva a una subasignaci\u00f3n de la memoria de la pila y, posteriormente, a un desbordamiento del b\u00fafer explotable en la regi\u00f3n heap de la memoria al cargar un archivo PNG dise\u00f1ado"}], "id": "CVE-2020-28248", "lastModified": "2026-06-17T03:10:14.540", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-20T00:15:12.483", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/gemini-testing/png-img"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/gemini-testing/png-img/commit/14ac462a32ca4b3b78f56502ac976d5b0222ce3d"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://securitylab.github.com/advisories/GHSL-2020-142-gemini-png-img"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/gemini-testing/png-img"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/gemini-testing/png-img/commit/14ac462a32ca4b3b78f56502ac976d5b0222ce3d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://securitylab.github.com/advisories/GHSL-2020-142-gemini-png-img"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}