Heap Out-of-Bounds Read Vulnerability in LodePNG Library
CVE-2026-112020

6.9MEDIUM

Key Information:

Vendor

Lvandeve

Status
Lodepng
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112020?

LodePNG versions up to 20261006 are susceptible to a heap out-of-bounds read vulnerability located in the lodepng::getFilterTypesInterlaced() function. This issue arises due to the absence of sufficient bounds checks on decompressed IDAT data. Attackers can create specially crafted interlaced PNG files that declare a raster size larger than the actual IDAT stream. By exploiting this weakness, attackers risk disclosing sensitive adjacent heap memory or causing applications to crash, leading to potential disruption and data exposure.

Affected Version(s)

lodepng 0 <= 20261006

References

https://hackmd.io/@haindpwn/lodepng-getfiltertypesinterla...
technical-description
https://github.com/lvandeve/lodepng/blob/e584a8490db1b76b...
technical-description
https://github.com/lvandeve/lodepng
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.