Medium severity · published Mar 8, 2026
CVE-2026-3713
pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libpng · pnggroup
1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +34 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3713
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3713
github.com
https://github.com/biniamf/pocs/tree/main/pnm2png
github.com
https://github.com/pnggroup/libpng/
github.com
https://github.com/pnggroup/libpng/issues/794
vuldb.com
https://vuldb.com/?ctiid.349658
vuldb.com
https://vuldb.com/?id.349658
vuldb.com
https://vuldb.com/?submit.761996
More from libpng
9.8
CVE-2017-12652
libpng before 1.6.32 does not properly check the length of chunks against the user limit
9.8
CVE-2010-1205
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG…
8.8
CVE-2018-14550
An issue has been found in third-party PNM decoding associated with libpng 1.6.35
8.8
CVE-2015-8540
Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19,…
8.8
CVE-2015-0973
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via…