Live › vulnerability › CVE-2026-112008
Go to dashboardlibmng, the library that decodes MNG animation files, sizes its ORDR entry buffer from 5-byte on-wire records but stores 8-byte entries in memory. A crafted MNG file makes it write attacker-controlled data past the allocation, which crashes the application and may allow more.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that call mng_read or mng_readdisplay on MNG files, including any service that accepts user-uploaded images. Systems that never decode MNG files are not exposed through this path.
No product ranges from the sources yet.
libmng in its dependency list or ldd output.mng-config --version or check the installed package version against 2.0.3.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-112008")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.