Vulnerability-Lookup

CVE-2026-40930 (GCVE-0-2026-40930)

Vulnerability from cvelistv5 – Published: 2026-06-04 14:34 – Updated: 2026-06-04 16:37

Title

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

Summary

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-436 - Interpretation Conflict

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/pnggroup/libpng/security/advis…	x_refsource_CONFIRM
https://github.com/pnggroup/libpng/commit/faf0692…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

2 products

Vendor	Product	Version
pnggroup	libpng	Affected: = 1.8.0
pnggroup	libpng-apng	Affected: >= 1.6.49, <= 1.6.57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-04T15:05:19.991Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/15/21"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T16:37:21.465127Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T16:37:38.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libpng",
          "vendor": "pnggroup",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.8.0"
            }
          ]
        },
        {
          "product": "libpng-apng",
          "vendor": "pnggroup",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.6.49, \u003c= 1.6.57"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T14:34:51.843Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x"
        },
        {
          "name": "https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4"
        }
      ],
      "source": {
        "advisory": "GHSA-c4v6-gxrq-6g2x",
        "discovery": "UNKNOWN"
      },
      "title": "LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40930",
    "datePublished": "2026-06-04T14:34:51.843Z",
    "dateReserved": "2026-04-15T20:40:15.518Z",
    "dateUpdated": "2026-06-04T16:37:38.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40930",
      "date": "2026-08-06",
      "epss": "0.00202",
      "percentile": "0.10336"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-23T14:43:39.000Z",
      "cve": "CVE-2026-40930",
      "id": "msrc_CVE-2026-40930",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:known_not_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-40930.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40930\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-04T16:16:36.633\",\"lastModified\":\"2026-07-22T20:10:00.127\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.\"},{\"lang\":\"es\",\"value\":\"LIBPNG es una biblioteca de referencia para su uso en aplicaciones que procesan archivos de imagen r\u00e1ster PNG (Portable Network Graphics). En la versi\u00f3n 1.8.0, tres rutas de descarte de fragmentos entre fotogramas en el analizador APNG en modo push borran el indicador de encabezado de fragmento sin consumir el cuerpo del fragmento y el CRC, permitiendo que bytes controlados por el atacante dentro de un fragmento auxiliar ignorado sean reinterpretados como un nuevo encabezado de fragmento en la siguiente llamada a \u0027png_process_data\u0027. El commit faf06924688b62d7c1654b5ceddedbde66ffadb4 soluciona el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"pnggroup\",\"product\":\"libpng\",\"versions\":[{\"version\":\"= 1.8.0\",\"status\":\"affected\"}]},{\"vendor\":\"pnggroup\",\"product\":\"libpng-apng\",\"versions\":[{\"version\":\"\u003e= 1.6.49, \u003c= 1.6.57\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-04T16:37:21.465127Z\",\"id\":\"CVE-2026-40930\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-436\"}]}],\"references\":[{\"url\":\"https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x\",\"source\":\"security-advisories@github.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/15/21\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/15/21\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-06-04T15:05:19.991Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40930\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-04T16:37:21.465127Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-04T16:37:32.334Z\"}}], \"cna\": {\"title\": \"LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body\", \"source\": {\"advisory\": \"GHSA-c4v6-gxrq-6g2x\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"pnggroup\", \"product\": \"libpng\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 1.8.0\"}]}, {\"vendor\": \"pnggroup\", \"product\": \"libpng-apng\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.6.49, \u003c= 1.6.57\"}]}], \"references\": [{\"url\": \"https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x\", \"name\": \"https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4\", \"name\": \"https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-436\", \"description\": \"CWE-436: Interpretation Conflict\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-04T14:34:51.843Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40930\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-04T16:37:38.286Z\", \"dateReserved\": \"2026-04-15T20:40:15.518Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-04T14:34:51.843Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-40930

Vulnerability from fkie_nvd - Published: 2026-06-04 16:16 - Updated: 2026-07-22 20:10

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4
	security-advisories@github.com	https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/05/15/21

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "libpng",
          "vendor": "pnggroup",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.8.0"
            }
          ]
        },
        {
          "product": "libpng-apng",
          "vendor": "pnggroup",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.6.49, \u003c= 1.6.57"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue."
    },
    {
      "lang": "es",
      "value": "LIBPNG es una biblioteca de referencia para su uso en aplicaciones que procesan archivos de imagen r\u00e1ster PNG (Portable Network Graphics). En la versi\u00f3n 1.8.0, tres rutas de descarte de fragmentos entre fotogramas en el analizador APNG en modo push borran el indicador de encabezado de fragmento sin consumir el cuerpo del fragmento y el CRC, permitiendo que bytes controlados por el atacante dentro de un fragmento auxiliar ignorado sean reinterpretados como un nuevo encabezado de fragmento en la siguiente llamada a \u0027png_process_data\u0027. El commit faf06924688b62d7c1654b5ceddedbde66ffadb4 soluciona el problema."
    }
  ],
  "id": "CVE-2026-40930",
  "lastModified": "2026-07-22T20:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40930",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-04T16:37:21.465127Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-04T16:16:36.633",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/15/21"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-436"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

MSRC_CVE-2026-40930

Vulnerability from csaf_microsoft - Published: 2026-06-02 00:00 - Updated: 2026-06-23 14:43

Summary

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-40930

CWE-436 - Interpretation Conflict

Affected products

Known not affected 3 products

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—
Unresolved product id: 17084-3		—
Unresolved product id: 17084-2		—

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-40930 LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-40930.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body",
    "tracking": {
      "current_release_date": "2026-06-23T14:43:39.000Z",
      "generator": {
        "date": "2026-06-24T07:03:47.768Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-40930",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-06-09T01:01:48.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-06-23T14:43:39.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "category": "product_name",
            "name": "azl3 libpng 0:1.6.58-1.azl3",
            "product": {
              "name": "azl3 libpng 0:1.6.58-1.azl3",
              "product_id": "1"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 qtbase 0:6.6.3-4.azl3",
            "product": {
              "name": "azl3 qtbase 0:6.6.3-4.azl3",
              "product_id": "3"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 tensorflow 0:2.16.1-11.azl3",
            "product": {
              "name": "azl3 tensorflow 0:2.16.1-11.azl3",
              "product_id": "2"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 libpng 0:1.6.58-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 qtbase 0:6.6.3-4.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 tensorflow 0:2.16.1-11.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-40930",
      "cwe": {
        "id": "CWE-436",
        "name": "Interpretation Conflict"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17084-3",
            "17084-2"
          ]
        },
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "17084-1",
          "17084-3",
          "17084-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-40930 LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-40930.json"
        }
      ],
      "title": "LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body"
    }
  ]
}

ubuntu-cve-2026-40930

Vulnerability from osv_ubuntu

Published

2026-06-04 16:16

Modified

2026-06-11 13:04

Summary

Details

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Severity

5.4 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-40930	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-40930	REPORT
	https://github.com/pnggroup/libpng/security/advis…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libpng-tools",
            "binary_version": "1.6.37-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "libpng16-16",
            "binary_version": "1.6.37-2ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "libpng1.6",
        "purl": "pkg:deb/ubuntu/libpng1.6@1.6.37-2ubuntu0.1~esm2?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.6.37-1",
        "1.6.37-2",
        "1.6.37-2ubuntu0.1~esm1",
        "1.6.37-2ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libpng-tools",
            "binary_version": "1.6.37-3ubuntu0.5"
          },
          {
            "binary_name": "libpng16-16",
            "binary_version": "1.6.37-3ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libpng1.6",
        "purl": "pkg:deb/ubuntu/libpng1.6@1.6.37-3ubuntu0.5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.6.37-3build4",
        "1.6.37-3build5",
        "1.6.37-3ubuntu0.1",
        "1.6.37-3ubuntu0.3",
        "1.6.37-3ubuntu0.4",
        "1.6.37-3ubuntu0.5"
      ]
    }
  ],
  "aliases": [],
  "details": "LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.",
  "id": "UBUNTU-CVE-2026-40930",
  "modified": "2026-06-11T13:04:28Z",
  "published": "2026-06-04T16:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-40930"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40930"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-40930"
  ]
}

WID-SEC-W-2026-1559

Vulnerability from csaf_certbund - Published: 2026-05-17 22:00 - Updated: 2026-06-09 22:00

Summary

libpng: Schwachstelle ermöglicht Denial of Service

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Die libpng ist die offizielle Referenzbibliothek für die Darstellung und Manipulation von Bildern im Portable Network Graphics (PNG) Format.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libpng ausnutzen, um einen Denial of Service Angriff durchzuführen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-40930

Affected products

Known affected 3 products

Product	Identifier	Version
Open Source libpng <1.8.0 faf0692468 Open Source / libpng		<1.8.0 faf0692468
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://seclists.org/oss-sec/2026/q2/548	external
https://github.com/pnggroup/libpng/security/advis…	external
https://alas.aws.amazon.com/AL2/ALAS2-2026-3340.html	external
https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2026…	external
https://msrc.microsoft.com/update-guide/	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die libpng ist die offizielle Referenzbibliothek f\u00fcr die Darstellung und Manipulation von Bildern im Portable Network Graphics (PNG) Format.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libpng ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1559 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1559.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1559 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1559"
      },
      {
        "category": "external",
        "summary": "OSS Security Mailing List vom 2026-05-17",
        "url": "https://seclists.org/oss-sec/2026/q2/548"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-c4v6-gxrq-6g2x vom 2026-05-17",
        "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2026-3340 vom 2026-06-09",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2026-3340.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2FIREFOX-2026-061 vom 2026-06-08",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2026-061.html"
      },
      {
        "category": "external",
        "summary": "Microsoft Security Update Guide vom 2026-06-09",
        "url": "https://msrc.microsoft.com/update-guide/"
      }
    ],
    "source_lang": "en-US",
    "title": "libpng: Schwachstelle erm\u00f6glicht Denial of Service",
    "tracking": {
      "current_release_date": "2026-06-09T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-10T07:36:33.642+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1559",
      "initial_release_date": "2026-05-17T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-17T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-04T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-34287"
        },
        {
          "date": "2026-06-08T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2026-06-09T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "azl3",
                "product": {
                  "name": "Microsoft Azure Linux azl3",
                  "product_id": "T049210",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:microsoft:azure_linux:azl3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.8.0 faf0692468",
                "product": {
                  "name": "Open Source libpng \u003c1.8.0 faf0692468",
                  "product_id": "T054242"
                }
              },
              {
                "category": "product_version",
                "name": "1.8.0 faf0692468",
                "product": {
                  "name": "Open Source libpng 1.8.0 faf0692468",
                  "product_id": "T054242-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:libpng:libpng:1.8.0_faf0692468"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "libpng"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-40930",
      "product_status": {
        "known_affected": [
          "T054242",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-17T22:00:00.000+00:00",
      "title": "CVE-2026-40930"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-40930 (GCVE-0-2026-40930)

FKIE_CVE-2026-40930

MSRC_CVE-2026-40930

ubuntu-cve-2026-40930

Vulnerability from osv_ubuntu

WID-SEC-W-2026-1559

Tags

Sightings

Nomenclature