libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because… (CVE-2026-112008)

The vulnerability in libmng up to version 2.0.3 is a heap-based buffer overflow in the mng_read_ordr() function. The root cause is that ORDR entry buffers are allocated based on 5-byte on-wire record sizes, while the actual in-memory entries require 8 bytes. This mismatch allows an attacker to supply a specially crafted MNG file with MHDR, DHDR, and multiple ORDR records, causing writes beyond the allocated buffer. This heap corruption can lead to application crashes when functions like mng_read or mng_readdisplay process the malicious file.

Successful exploitation results in heap memory corruption and application crashes. The CVSS score of 6.1 (medium severity) reflects limited impact on confidentiality and integrity but high impact on availability. There is no indication of code execution or data disclosure from the provided data.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted MNG files or use alternative libraries.