The kanidmd_lib image upload handlers validate image data before performing authorization checks, allowing unauthenticated users to trigger image validator code. A specific bug in the PNG validator causes a panic on malformed inputs, such as very short files or those with chunk-length fields near the maximum 32-bit integer value. This panic only aborts the requester's own task without affecting the overall server process or other connections. However, if compiled with panic set to abort, it could cause a full unauthenticated process crash. The issue affects versions from 1.1.0-rc.15 through before 1.9.3 and has been fixed in version 1.9.3.