Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112008— libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr

Quick assessment

Affected
libmng libmng
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libmng（2.0.3 及更早版本）在 函数中存在一个基于堆的缓冲区溢出漏洞。该漏洞源于 ORDR 条目缓冲区的大小是根据 5 字节的网络传输记录来分配的，而实际在内存中每个条目需要 8 字节。攻击者可构造一个包含 MHDR、DHDR 以及多记录 ORDR 块的 MNG 文件，供调用 或 的应用程序处理，从而将攻击者控制的数据写入已分配内存之后，导致应用程序崩溃。

CVSS 6.1 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
libmng libmng ≤ 2.0.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112008

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr
Source: CVE Program / CVE List V5
Vulnerability Description
libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
缓冲区大小计算不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
libmng libmng 0 ~ 2.0.3 -

II. Public POCs for CVE-2026-112008

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112008

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-112008 (1)

Vendor Pages for CVE-2026-112008 (1)

IV. Related Vulnerabilities

Same weakness: CWE-131

V. Comments for CVE-2026-112008

No comments yet

Leave a comment