CVE Feed

    Dashboard / CVE / CVE-2026-40930

    CVE-2026-40930

    LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

    Published:Jun 4, 2026
    Last Modified:Jun 5, 2026
    EPS:Jun 4, 2026
    EPSS Score:
    CVSS Score:5.4

    Affected Products

    Vendor
    Pnggroup
    Product
    Libpng

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-436 Interpretation Conflict

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High