CVE-2026-40930
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
LIBPNG version 1.8.0 has a bug in the push-mode APNG parser: three inter-frame chunk discard paths do not consume the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data.
Risk Assessment
An attacker could supply a crafted PNG image that, when processed, may cause unexpected application behavior, potentially leading to code execution or data leakage.
Recommendation
Update the LIBPNG library to a version containing commit faf06924688b62d7c1654b5ceddedbde66ffadb4 or later.
Other vulnerabilities in LIBPNG
See all- CVE-2016-10087High
The png_set_text_2 function in libpng before versions 1.0.67, 1.2.57, 1.4.20, 1.5.28, and 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference. This issue occurs when loading a text chunk into a png structure, removing the text, and then adding another text chunk.
- CVE-2016-3751High
Unspecified vulnerability in libpng before version 1.6.20, used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before July 1, 2016, allows attackers to gain privileges via a crafted application.
- CVE-2015-8540High
An integer underflow in the png_check_keyword function in pngwutil.c in libpng allows remote attackers to trigger an out-of-bounds read by using a space character as a keyword in a PNG image.
- CVE-2015-8472High
Buffer overflow in the png_set_PLTE function in libpng before version 1.0.65 and in versions 1.1.x, 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause application crashes or possibly have unspecified other impacts via a small bit-depth value in an IHDR (image header) chunk in a PNG image.
- CVE-2015-8126High
Multiple buffer overflows in the png_set_PLTE and png_get_PLTE functions in libpng before version 1.0.64 and in versions 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, and 1.6.x before their respective versions may allow remote attackers to cause application crashes or potentially other unspecified impacts via a small bit-depth value in an IHDR (image header) chunk in a PNG image.
- CVE-2015-0973High
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width.
- CVE-2014-9495High
Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16 may allow context-dependent attackers to execute arbitrary code via a 'very wide interlaced' PNG image on 64-bit systems.
- CVE-2026-25646High
In LIBPNG prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() function. When called with no histogram and the number of colors in the palette exceeds twice the maximum supported by the display, certain palettes cause an infinite loop reading past the end of a heap buffer. The triggering images are valid per the PNG specification.
Original NVD description (English source)
LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.