CVE-2026-112008: libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr
libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mngreadordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mngread or mngreaddisplay, writing attacker-controlled data past the allocation and crashing the application.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this flaw?
Applications using libmng through 2.0.3 are exposed when they process attacker-supplied MNG files through mng_read or mng_readdisplay. The affected parsing path handles ORDR chunks.
What must an attacker provide to trigger the issue?
An attacker needs to induce the application to process a crafted MNG file containing MHDR and DHDR chunks and a multi-record ORDR chunk. No privileges are required, but user interaction is required according to the supplied vector.
What is the observed impact of successful exploitation?
The crafted ORDR chunk causes attacker-controlled data to be written past a heap allocation, corrupting heap memory. The described result is an application crash, with high availability impact and low integrity impact.