PT-2026-23921 · Libpng · Libpng

Biniam · Published 2026-03-08 · Updated 2026-03-11 · CVE-2026-3713

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions libpng versions up to 1.6.55

Description A heap-based buffer overflow exists in the

do pnm2png

function within the

pnm2png.c

file of the

pnm2png

component. The issue is triggered by manipulating the

width

and

height

arguments. Exploitation is restricted to local execution, and an exploit has been published. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 1.6.55 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-119

Related Identifiers

CVE-2026-3713

Affected Products

Libpng

References · 12

• 🔥 https://github.com/biniamf/pocs/tree/main/pnm2png · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3713 · Security Note
• https://github.com/pnggroup/libpng/issues/794 · Note
• https://vuldb.com/?submit.761996 · Note
• https://t.me/msrcreports/3347 · Telegram Post
• https://github.com/pnggroup/libpng · Note
• https://twitter.com/VulmonFeeds/status/2030562618671280434 · Twitter Post
• https://t.me/cveNotify/154664 · Telegram Post
• https://twitter.com/CVEnew/status/2030747878319411445 · Twitter Post
• https://t.me/CVEtracker/46787 · Telegram Post
• https://vuldb.com/?ctiid.349658 · Note
• https://vuldb.com/?id.349658 · Note