Threats Tagged 'cve-2026-40930'

A vulnerability in libpng version 1.8.0 involves an interpretation conflict in the APNG parser's handling of ancillary chunks. Specifically, certain discard paths clear the chunk-header flag without consuming the chunk body and CRC, which may allow attacker-controlled data to be misinterpreted as new chunk headers. This issue is identified as CWE-436 and has a CVSS score of 5.4, indicating medium severity.

A moderate security vulnerability (CVE-2026-40930) exists in libpng, a library used for processing PNG and Animated PNG (APNG) image files. The flaw allows a remote attacker to craft a malicious APNG file that causes the application to misinterpret attacker-controlled data as a new chunk header, potentially leading to denial of service or unexpected application behavior affecting data integrity and availability. Red Hat has issued updated RPM packages for Red Hat Hardened Images including libpng version 1.6.58-1.hum1 to address this issue. No direct exploit has been observed in the wild. Mitigations other than the update are not currently available or recommended by Red Hat.