Live › vulnerability › CVE-2026-112020
Go to dashboardLodePNG's getFilterTypesInterlaced() function in lodepng_util.cpp does not bounds-check decompressed IDAT data, so a crafted interlaced PNG whose declared raster is larger than its IDAT stream makes it read adjacent heap memory. An attacker can use this to leak nearby heap contents or crash the application that decodes the image.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that decode untrusted PNG files with LodePNG's interlaced-image path, such as image upload, thumbnailing or conversion services, are exposed. Software that only decodes images it generated itself, or that never accepts interlaced PNGs from outside, is unlikely to be reached. The sources do not name affected LodePNG versions beyond 'through 20261006'.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.
This page as .md · .json · in your agent: get_signal("CVE-2026-112020")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.