---
id: "CVE-2026-112020"
kind: "vulnerability"
aliases: ["CVE-2026-112020"]
title: "LodePNG: crafted interlaced PNG reads past heap buffer"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "image-processing", "lodepng", "package"]
not_affected_if: ["trusted-input-only"]
published_at: "2026-10-18T12:17:15+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:40:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112020", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# LodePNG: crafted interlaced PNG reads past heap buffer

LodePNG's getFilterTypesInterlaced() function in lodepng_util.cpp does not bounds-check decompressed IDAT data, so a crafted interlaced PNG whose declared raster is larger than its IDAT stream makes it read adjacent heap memory. An attacker can use this to leak nearby heap contents or crash the application that decodes the image.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112020

## From the sources

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_