CVE-2026-112020: Out-of-bounds Read in lvandeve lodepng

LodePNG versions up to 0 contain a heap out-of-bounds read vulnerability in the lodepng::getFilterTypesInterlaced() function located in lodepng_util.cpp. The vulnerability arises because the function does not perform proper bounds checking on decompressed IDAT data. An attacker can exploit this by supplying a malicious interlaced PNG image that specifies a raster size larger than the available IDAT stream, causing the program to read beyond allocated heap memory. This can result in information disclosure or application crashes. The CVSS 4.0 base score is 6.9, reflecting a medium severity with local attack vector, low complexity, no privileges required, and user interaction needed.

Successful exploitation can lead to disclosure of adjacent heap memory contents, potentially leaking sensitive information, or cause application crashes due to out-of-bounds memory access. The vulnerability requires local access and user interaction, limiting remote exploitation. There are no known exploits in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted interlaced PNG images with affected versions of lodepng.