CVE-2026-112008 in libmng
Summary
by MITRE • 10/18/2026
libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified within libmng versions up to 2.0.3 represents a critical heap-based buffer overflow located specifically in the mng_read_ordr function. This flaw stems from a fundamental discrepancy between how memory is allocated for ORDR chunk entries and how that memory is subsequently populated with data derived from input files. The MNG image format utilizes various chunks to define metadata and display parameters, including the ORDR chunk which specifies ordering information for multiple images within an animated sequence. When processing this chunk, the library calculates buffer sizes based on five-byte records found in the wire-format representation of the file. However, the internal data structures used by libmng require eight bytes per entry to function correctly and maintain alignment integrity. This mismatch creates a scenario where the allocated heap memory is significantly smaller than what the subsequent write operations attempt to consume.
During normal operation, an application utilizing libmng will parse incoming MNG files through functions such as mng_read or mng_readdisplay. When these functions encounter an ORDR chunk containing multiple records, they invoke mng_read_ordr to process the ordering data. Because the function relies on the five-byte size calculation for allocation but proceeds to write eight-byte entries into that space, it inevitably writes beyond the bounds of the allocated heap buffer. This out-of-bounds write allows an attacker who controls the content of a crafted MNG file to overwrite adjacent memory regions on the heap with arbitrary data. The specific nature of this overflow means that critical metadata structures, function pointers, or other control data residing in nearby heap allocations can be corrupted, fundamentally altering the execution flow of the vulnerable application.
The operational impact of this vulnerability is severe, primarily manifesting as a denial of service through application crashes when the memory corruption triggers an immediate fault. However, given the nature of heap overflows, there is also a high potential for remote code execution if an attacker can carefully craft the overflow to overwrite specific control structures such as function pointers or object vtables. This aligns with common exploitation techniques where precise memory layout manipulation leads to arbitrary code execution under the context of the victim process. The vulnerability affects any software that integrates libmng and processes untrusted MNG image files, including web browsers, image viewers, and document processors that support animated graphics formats.
From a classification perspective, this issue is categorized as CWE-122 Heap-based Buffer Overflow, reflecting the out-of-bounds write to dynamically allocated memory. It also relates to CWE-685 Function Call With Incorrect Number of Arguments or Parameters in terms of the internal logic error regarding size calculation versus actual data consumption. In the context of attack tactics, this vulnerability facilitates initial access and potential privilege escalation through exploitation techniques associated with TA0004 Privilege Escalation and TA0001 Initial Access within the MITRE ATT&CK framework, specifically leveraging memory corruption to gain control over program execution flow.
Mitigation strategies for this vulnerability involve immediate updates to libmng or any dependent libraries that incorporate patched versions of the codebase where the buffer size calculation has been corrected to match the eight-byte requirement of in-memory entries. For organizations unable to update immediately, input validation mechanisms should be implemented at the application layer to reject MNG files with ORDR chunks containing record counts that would result in excessive memory allocation requirements relative to file size constraints. Additionally, enabling heap protection features such as Address Space Layout Randomization and stack canaries where available can help mitigate exploitation attempts by making it more difficult for attackers to predict target addresses or detect successful overwrites before execution is interrupted.