CVE-2007-5266

MEDIUM 4.3CVE-2007-5266 · Published 08/10/2007 · updated 16/06/2026

In short

CVE-2007-5266 is a MEDIUM (CVSS 4.3) vulnerability affecting libpng (libpng).
Chance of exploitation in the next 30 days (EPSS): 3.4%, higher than 88.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libpng libpng	`≥ 1.2.0, ≤ 1.2.20≤ 1.0.28`	No fix yet

Description

Off-by-one error in ICC profile chunk handling in the png_set_iCCP function in pngset.c in libpng before 1.0.29 beta1 and 1.2.x before 1.2.21 beta1 allows remote attackers to cause a denial of service (crash) via a crafted PNG image that prevents a name field from being NULL terminated.

References

android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html · Third Party Advisory
bugs.gentoo.org/show_bug.cgi · Third Party Advisory
docs.info.apple.com/article.html · Third Party Advisory
lists.apple.com/archives/security-announce/2008//May/msg00001.html · Mailing List
lists.apple.com/archives/security-announce/2008/Mar/msg00001.html · Mailing List
secunia.com/advisories/27284 · Third Party Advisory
secunia.com/advisories/27529 · Third Party Advisory
secunia.com/advisories/27629 · Third Party Advisory
secunia.com/advisories/27746 · Third Party Advisory
secunia.com/advisories/29420 · Third Party Advisory
secunia.com/advisories/30161 · Third Party Advisory
secunia.com/advisories/30430

More vulnerabilities in libpng

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libpng

≥ 1.2.0, ≤ 1.2.20≤ 1.0.28

No fix yet

More vulnerabilities in libpng

See all →