Threats Tagged 'cve-2026-40930'

A vulnerability in libpng version 1.8.0 involves an interpretation conflict in the APNG parser's handling of ancillary chunks. Specifically, certain discard paths clear the chunk-header flag without consuming the chunk body and CRC, which may allow attacker-controlled data to be misinterpreted as new chunk headers. This issue is identified as CWE-436 and has a CVSS score of 5.4, indicating medium severity.

A moderate security flaw (CVE-2026-40930) was found in libpng, a library used for processing PNG image files, including Animated PNGs (APNG). The vulnerability allows a remote attacker to craft a malicious APNG file that causes the application to misinterpret attacker-controlled data as a new chunk header. This can lead to denial of service or unexpected application behavior affecting data integrity and availability. Red Hat has issued an update for Red Hat Hardened Images RPMs including libpng version 1.6.58-1.hum1 to address this issue. No direct patch link is provided, but the advisory references updated RPMs. Mitigations are currently not available or do not meet Red Hat's criteria for deployment. The vulnerability has not been observed exploited in the wild.