Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112020— LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()

Quick assessment

Affected
lvandeve lodepng
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

截至 2026 年 10 月 6 日的 LodePNG 版本在 文件的 函数中存在堆越界读取漏洞。该漏洞源于对解压后的 IDAT 数据缺乏边界检查。攻击者可构造一个交织型 PNG 文件，声明其光栅尺寸大于其 IDAT 数据流实际大小，从而泄露相邻的堆内存或导致应用程序崩溃。

CVSS 6.1 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
lvandeve lodepng ≤ 20261006 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112020

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
Source: CVE Program / CVE List V5
Vulnerability Description
LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
lvandeve lodepng 0 ~ 20261006 -

II. Public POCs for CVE-2026-112020

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112020

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-112020 (1)

Security Blog Posts for CVE-2026-112020 (1)

Vendor Pages for CVE-2026-112020 (1)

IV. Related Vulnerabilities

Same weakness: CWE-125

V. Comments for CVE-2026-112020

No comments yet

Leave a comment