CVE-2026-112020: LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()

Q: What conditions are required to exploit this issue?

An attacker needs to get an application using the affected LodePNG code to process a crafted interlaced PNG. The PNG declares a raster larger than the decompressed IDAT stream, causing getFilterTypesInterlaced() to read beyond the heap buffer.

Q: What is the likely impact on an affected application?

The out-of-bounds read can disclose adjacent heap memory or crash the application. The provided severity vector indicates local attack vector, no privileges required, and user interaction required.

Q: How can I determine whether my application may be affected?

Review whether the application uses LodePNG through 20261006 and processes interlaced PNG files. The relevant code path is lodepng::getFilterTypesInterlaced() in lodepng_util.cpp.

Published Oct 18, 2026

Updated

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepngutil.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.

Affected Software

1 affected component

LodePNG LodePNG<=20261006

Event History

Oct 18, 2026

CVE Published

via MITRE·11:38 AM

Data Sourced

via MITRE·11:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker needs to get an application using the affected LodePNG code to process a crafted interlaced PNG. The PNG declares a raster larger than the decompressed IDAT stream, causing getFilterTypesInterlaced() to read beyond the heap buffer.

What is the likely impact on an affected application?

The out-of-bounds read can disclose adjacent heap memory or crash the application. The provided severity vector indicates local attack vector, no privileges required, and user interaction required.

How can I determine whether my application may be affected?

Review whether the application uses LodePNG through 20261006 and processes interlaced PNG files. The relevant code path is lodepng::getFilterTypesInterlaced() in lodepng_util.cpp.

CVE-2026-112020: LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()

Affected Software

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

What is the likely impact on an affected application?

How can I determine whether my application may be affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

What is the likely impact on an affected application?

How can I determine whether my application may be affected?