pnggroup libpng up to 1.6.55 pnm2png pnm2png.c do_pnm2png width/height heap-based overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in pnggroup libpng up to 1.6.55. Affected by this issue is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. Such manipulation of the argument width/height leads to heap-based overflow. This vulnerability is listed as CVE-2026-3713. The attack must be carried out locally. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability was found in pnggroup libpng up to 1.6.55. It has been rated as critical. Affected by this issue is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. The manipulation of the argument width/height with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-3713. The exploitation is known to be easy. Local access is required to approach this attack. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. The project was informed of the problem early through an issue report but has not responded yet. The vulnerability scanner Nessus provides a plugin with the ID 301483 (Linux Distros Unpatched Vulnerability : CVE-2026-3713), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (301483) and EUVD (EUVD-2026-10219). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Image Processing Software

Vendor

• pnggroup

Name

• libpng

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17
• 1.6.18
• 1.6.19
• 1.6.20
• 1.6.21
• 1.6.22
• 1.6.23
• 1.6.24
• 1.6.25
• 1.6.26
• 1.6.27
• 1.6.28
• 1.6.29
• 1.6.30
• 1.6.31
• 1.6.32
• 1.6.33
• 1.6.34
• 1.6.35
• 1.6.36
• 1.6.37
• 1.6.38
• 1.6.39
• 1.6.40
• 1.6.41
• 1.6.42
• 1.6.43
• 1.6.44
• 1.6.45
• 1.6.46
• 1.6.47
• 1.6.48
• 1.6.49
• 1.6.50
• 1.6.51
• 1.6.52
• 1.6.53
• 1.6.54
• 1.6.55

License

• open-source

Website

• Product: https://github.com/pnggroup/libpng/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #761996: libpng pnm2png 1.8.0 Integer Overflow to Buffer Overflow (by biniam)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion