LI
Product
Libpng
57
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 18Medium 16Low 0
Watch
Add Libpng to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12652 | 9.8 | Jul 10 | libpng before 1.6.32 does not properly check the length of chunks against the user limit Affected: before 1.6.32 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: before 1.2.44; 1.4.0 before 1.4.3 |
| CVE-2018-14550 | 8.8 | Jul 10 | An issue has been found in third-party PNM decoding associated with libpng 1.6.35 Affected: 1.6.35 |
| CVE-2015-8540 | 8.8 | Apr 14 | Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19,… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +34 more |
| CVE-2015-0973 | 8.8 | Jan 18 | Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via… Affected: through 1.5.20; 1.6.0; 1.6.0; 1.6.1; 1.6.1; 1.6.2; +24 more |
| CVE-2014-9495 | 8.8 | Jan 10 | Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers… Affected: through 1.5.20; 1.6.0; 1.6.0; 1.6.1; 1.6.1; 1.6.2; +24 more |
| CVE-2011-3045 | 8.8 | Mar 22 | Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote… Affected: before 1.5.10 |
| CVE-2011-2692 | 8.8 | Jul 17 | The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL… Affected: 1.0.0 before 1.0.55; 1.2.0 before 1.2.45; 1.4.0 before 1.4.8; 1.5.0 before 1.5.4 |
| CVE-2011-2690 | 8.8 | Jul 17 | Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the png_rgb_to_gray function… Affected: 1.0.0 before 1.0.55; 1.2.0 before 1.2.45; 1.4.0 before 1.4.8; 1.5.0 before 1.5.4 |
| CVE-2026-25646 | 8.1 | Feb 10 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files Affected: before 1.6.55 |
| CVE-2026-22801 | 7.8 | Jan 12 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files Affected: 1.6.26 before 1.6.54 |
| CVE-2016-3751 | 7.8 | Jul 11 | Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows attackers to gain… Affected: through 1.6.19 |
| CVE-2026-33636 | 7.6 | Mar 26 | LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 Affected: 1.6.36 before 1.6.56 |
| CVE-2026-33416 | 7.5 | Mar 26 | LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` Affected: 1.2.1 before 1.6.56 |
| CVE-2016-10087 | 7.5 | Jan 30 | The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers… Affected: 0.8; 0.71; 0.81; 0.82; 0.85; 0.86; +34 more |
| CVE-2015-8472 | 7.3 | Jan 21 | Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20… Affected: 1.0.64; 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; +34 more |
| CVE-2026-22695 | 7.1 | Jan 12 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files Affected: 1.6.51 before 1.6.54 |
| CVE-2025-66293 | 7.1 | Dec 3 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files Affected: before 1.6.52 |
| CVE-2025-65018 | 7.1 | Nov 25 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files Affected: 1.6.0 before 1.6.51 |
| CVE-2025-64720 | 7.1 | Nov 25 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files Affected: 1.6.0 before 1.6.51 |
| CVE-2019-6129 | 6.5 | Jan 11 | png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp Affected: 1.6.36 |
| CVE-2018-14048 | 6.5 | Jul 13 | An issue has been found in libpng 1.6.34 Affected: 1.6.34 |
| CVE-2018-13785 | 6.5 | Jul 9 | In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while… Affected: 1.6.34 |
| CVE-2013-7354 | 6.5 | May 6 | Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2)… Affected: through 1.5.13; 1.5.0; 1.5.1; 1.5.1; 1.5.2; 1.5.2; +18 more |
| CVE-2013-7353 | 6.5 | May 6 | Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service… Affected: through 1.5.13; 1.5.0; 1.5.1; 1.5.1; 1.5.2; 1.5.2; +18 more |
| CVE-2013-6954 | 6.5 | Jan 12 | The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE… Affected: through 1.6.8; 1.6.0; 1.6.0; 1.6.1; 1.6.1; 1.6.2; +9 more |
| CVE-2011-2691 | 6.5 | Jul 17 | The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer… Affected: 1.0.0 before 1.0.55; 1.2.0 before 1.2.45; 1.4.0 before 1.4.8; 1.5.0 before 1.5.4 |
| CVE-2011-2501 | 6.5 | Jul 17 | The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a… Affected: 1.0.0 before 1.0.55; 1.2.0 before 1.2.45; 1.4.0 before 1.4.8; 1.5.0 before 1.5.4 |
| CVE-2010-2249 | 6.5 | Jun 30 | Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a… Affected: before 1.2.44; 1.4.0 before 1.4.3 |
| CVE-2025-64506 | 6.1 | Nov 25 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files Affected: 1.6.0 before 1.6.51 |
| CVE-2025-64505 | 6.1 | Nov 25 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files Affected: before 1.6.51 |
| CVE-2025-28164 | 5.5 | Jan 27 | Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function Affected: 1.6.43 through 1.6.46 |
| CVE-2025-28162 | 5.5 | Jan 27 | Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory… Affected: 1.6.43 through 1.6.46 |
| CVE-2021-4214 | 5.5 | Aug 24 | A heap overflow flaw was found in libpngs' pngimage.c program Affected: 1.6.0 |
| CVE-2019-7317 | 5.3 | Feb 4 | png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute Affected: 1.6.0 before 1.6.37 |
| CVE-2026-34757 | 4.4 | Apr 9 | LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosure Affected: 1.0.9 before 1.6.57 |
| CVE-2015-7981 | – | Nov 24 | The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.5; 1.0.6; +34 more |
| CVE-2015-8126 | – | Nov 13 | Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x… Affected: before 1.0.64; 1.1.1 before 1.2.54; 1.3.0 before 1.4.17; 1.5.0 before 1.5.24; 1.6.0 before 1.6.19 |
| CVE-2014-0333 | – | Feb 27 | The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU… Affected: 1.6.0; 1.6.0; 1.6.1; 1.6.1; 1.6.2; 1.6.2; +12 more |
| CVE-2012-3425 | – | Aug 13 | The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +34 more |
| CVE-2011-3464 | – | Jul 22 | Off-by-one error in the png_formatted_warning function in pngerror.c in libpng 1.5.4 through 1.5.7 might allow remote attackers to cause a denial of service (application crash)… Affected: 1.5.0; 1.5.1; 1.5.1; 1.5.2; 1.5.2; 1.5.3; +8 more |
| CVE-2011-3048 | – | May 29 | The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.5; 1.0.6; +34 more |
| CVE-2009-5063 | – | Aug 31 | Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or… Affected: through 1.2.38; 1.2.39; 1.2.39; 1.2.39; 1.2.39; 1.2.39 |
| CVE-2006-7244 | – | Aug 31 | Memory leak in pngwutil.c in libpng 1.2.13beta1, and other versions before 1.2.15beta3, allows context-dependent attackers to cause a denial of service (memory leak or… Affected: through 1.2.15; 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.5; +34 more |
| CVE-2011-0408 | – | Jan 18 | pngrtran.c in libpng 1.5.x before 1.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted palette-based PNG… Affected: 1.5.0 |
| CVE-2010-0205 | – | Mar 3 | The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data… Affected: 1.0.0 before 1.0.53; 1.2.0 before 1.2.43; 1.4.0 before 1.4.1 |
| CVE-2009-2042 | – | Jun 12 | libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain… Affected: through 1.2.35; 0.89c; 0.95; 1.0.0; 1.0.1; 1.0.2; +34 more |
| CVE-2009-0040 | – | Feb 22 | The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of… Affected: before 1.0.43; 1.2.0 before 1.2.35 |
| CVE-2008-6218 | – | Feb 20 | Memory leak in the png_handle_tEXt function in pngrutil.c in libpng before 1.2.33 rc02 and 1.4.0 beta36 allows context-dependent attackers to cause a denial of service (memory… Affected: 1.2.0; 1.2.0; 1.2.0; 1.2.0; 1.2.0; 1.2.0; +34 more |
| CVE-2008-5907 | – | Jan 15 | The png_check_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory… Affected: before 1.0.42; 1.2.0 before 1.2.34 |