{"id":"CVE-2026-112020","kind":"vulnerability","aliases":["CVE-2026-112020"],"related":[],"title":"LodePNG: crafted interlaced PNG reads past heap buffer","description":"LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.","summary":"LodePNG's getFilterTypesInterlaced() function in lodepng_util.cpp does not bounds-check decompressed IDAT data, so a crafted interlaced PNG whose declared raster is larger than its IDAT stream makes it read adjacent heap memory. An attacker can use this to leak nearby heap contents or crash the application that decodes the image.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","image-processing","lodepng","package"],"not_affected_if":["trusted-input-only"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T12:17:15+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:40:58+00:00","updated_at":"2026-10-25T03:40:58+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:40:58Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"LodePNG: crafted interlaced PNG reads past heap buffer","impact":"medium","summary":"LodePNG's getFilterTypesInterlaced() function in lodepng_util.cpp does not bounds-check decompressed IDAT data, so a crafted interlaced PNG whose declared raster is larger than its IDAT stream makes it read adjacent heap memory. An attacker can use this to leak nearby heap contents or crash the application that decodes the image.","category":"package","nicknames":[],"who_cares":["lodepng","c++","image-processing"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Heap memory leaks or the decoding application crashes","analyst_note":"Check the NVD entry and the LodePNG upstream repository for the fixed version, affected version range and whether the out-of-bounds read can leak data beyond a crash.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Applications that decode untrusted PNG files with LodePNG's interlaced-image path, such as image upload, thumbnailing or conversion services, are exposed. Software that only decodes images it generated itself, or that never accepts interlaced PNGs from outside, is unlikely to be reached. The sources do not name affected LodePNG versions beyond 'through 20261006'.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000599,"input_tokens":3361,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112020':11A,14A '-2026':10A,13A '20261006':75C 'adjac':52B,115C 'applic':68B,120C 'attack':56B,98C 'bound':30B,82C,92C 'bounds-check':29B 'buffer':8A 'c':15B 'check':31B,93C 'contain':76C 'content':64B 'craft':2A,37B,102C 'crash':66B,119C 'cve':9A,12A 'data':34B,97C 'declar':41B,105C 'decod':70B 'decompress':32B,95C 'disclos':114C 'function':24B 'getfiltertypesinterlac':23B,87C 'heap':7A,53B,63B,78C,116C 'idat':33B,47B,96C,111C 'imag':17B,72B 'image-process':16B 'interlac':3A,38B,103C 'lack':91C 'larger':44B,108C 'leak':61B 'lodepng':1A,19B,21B,73C,86C 'lodepng_util.cpp':26B,89C 'make':49B 'memori':54B,117C 'nearbi':62B 'out-of-bound':79C 'packag':20B 'past':6A 'png':4A,39B,104C 'process':18B 'raster':42B,107C 'read':5A,51B,83C 'stream':48B,112C 'suppli':100C 'use':58B 'vulner':84C 'whose':40B","nicknames":[],"mitigations":[],"who_affected":"Applications that decode untrusted PNG files with LodePNG's interlaced-image path, such as image upload, thumbnailing or conversion services, are exposed. Software that only decodes images it generated itself, or that never accepts interlaced PNGs from outside, is unlikely to be reached. The sources do not name affected LodePNG versions beyond 'through 20261006'.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112020","severity":null,"published_at":"2026-10-18T12:17:15+00:00","modified_at":"2026-10-22T03:16:33+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}