CVE-2025-28162

Published: Jan 27, 2026Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive

Affected (1)

Products: Libpng: Libpng

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libpng Libpng	From 1.6.43 to 1.6.46

Related CWEs

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (2)

https://gist.github.com/kittener/fbfdb9b5610c6b3db0d5dea045a07c60

Source: cve@mitre.org

Third Party Advisory

https://github.com/pnggroup/libpng/issues/656

Source: cve@mitre.org

ExploitIssue Tracking

Timeline

No history available yet.