CVE-2026-3713

Description

A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

https://vuldb.com/?submit.761996

https://vuldb.com/?id.349658

https://vuldb.com/?ctiid.349658

https://github.com/pnggroup/libpng/issues/794

https://github.com/pnggroup/libpng/

https://github.com/biniamf/pocs/tree/main/pnm2png

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS