CVE-2026-40930
Published:June 04, 2026
Updated:June 07, 2026
LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to "png_process_data". Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.
Affected Packages
libpng (CONAN):
Affected version(s) >=1.5.30 <1.6.58Fix Suggestion:
Update to version 1.6.58https://github.com/pnggroup/libpng.git (GITHUB):
Affected version(s) >=v1.5.2 <v1.6.58Fix Suggestion:
Update to version v1.6.58Related Resources (3)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Interpretation Conflict
EPSS
Base Score:
0.03