VDB

CVE-2026-3713

CVE-2026-3713 PUBLISHED CVSS 4.800000190734863 MEDIUM

A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

EPSS 0.02% · 5.6th percentile

Risk Scores

CVSS 4.0
4.800000190734863
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS Score
0.02%
5.6th percentile

Affected Products

VendorProductVersions
pnggrouplibpng1.6.7, 1.6.0, 1.6.1

Timeline

  • Mar 8, 2026 EPSS Score
  • Mar 8, 2026 PoC Published
  • Mar 8, 2026 CVE Published
  • Mar 9, 2026 EPSS Score
  • Mar 10, 2026 EPSS Score
  • Mar 11, 2026 EPSS Score
  • Mar 11, 2026 CVE Updated
  • Mar 13, 2026 EPSS Score
  • Mar 14, 2026 EPSS Score
  • Mar 14, 2026 Coalition ESS Score
  • Mar 15, 2026 EPSS Score
  • Mar 16, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›