An underflow read was found in pngcheckkeyword in pngwutil.c in libpng-1.2.54:
If the data of "key" is only ' ' (0x20), it will read a byte before the buffer in line 1288.
This issue impacts upstream versions 1.2.55, 1.0.65, 1.4.18, and 1.5.25 of libpng.
An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image.
CVE assignment:
http://seclists.org/oss-sec/2015/q4/469
Upstream issue:
http://sourceforge.net/p/libpng/bugs/244/
Upstream patch:
http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815b42ed/
Last updated 18 August 2026
The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the pngreadpng function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.
From: Steve G <linux4ever>
In the pngformatbuffer function located in pngerror.c around line 133 is the following code:
if (message == NULL) buffer[iout] = 0; else { buffer[iout++] = ':'; buffer[iout++] = ' '; pngmemcpy(buffer+iout, message, 64); buffer[iout+63] = 0; } This code is called from the pngchunkerror & pngchunkwarning functions. An example of their use would be in pngutil.c around line 119. pngchunkerror(pngptr, "CRC error"); In the above code, the message being constructed is only 10 characters long. The pngmemcpy function will unconditionally access 54 bytes beyond the message.
This could cause a carefully crafted png image to cause a denial of service.
Possibly embargoed; marking as embargoed until communicated otherwise.
The pngpushreadzTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large availin field value in a PNG image.
libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.