Heap-Based Buffer Overflow in pnggroup libpng PNM to PNG Converter
CVE-2026-3713
Key Information:
Badges
What is CVE-2026-3713?
A vulnerability exists in versions of pnggroup libpng up to 1.6.55 affecting the do_pnm2png function within the pnm2png component. A manipulation of width and height arguments can result in a heap-based buffer overflow. This issue is limited to local execution, meaning an attacker must have local access to exploit the vulnerability. Despite the detection of this flaw through an early issue report, the libpng project has yet to provide a response or resolution. The exploit code has been published, indicating the potential for active exploitation.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
libpng 1.6.0
libpng 1.6.1
libpng 1.6.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved