Out-of-bounds write in libpng

HIGH 8.8CVE-2018-14550 · GHSA-qwwr-qc2p-6283 · Published 10/07/2019 · updated 17/06/2026

In short

CVE-2018-14550 is a HIGH (CVSS 8.8) vulnerability affecting libpng, libpng (libpng), hyperion infrastructure technology (oracle).
Chance of exploitation in the next 30 days (EPSS): 3.5%, higher than 89.3% of all vulnerabilities.
Fix: update to 1.6.37 or later.

Package	Affected versions	Patched versions
libpng NuGet	`< 1.6.37`	`1.6.37`
libpng libpng	`= 1.6.35`	No fix yet
hyperion infrastructure technology oracle	`= 11.1.2.6.0`	No fix yet
mysql workbench oracle	`≤ 8.0.23`	No fix yet

Description

An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.

NVD description

An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.

References

nvd.nist.gov/vuln/detail/CVE-2018-14550 · ADVISORY
glennrp/libpng · WEB
fouzhe/security · WEB
glennrp/libpng · PACKAGE
security.gentoo.org/glsa/201908-02 · WEB
security.netapp.com/advisory/ntap-20221028-0001 · WEB
snyk.io/vuln/SNYK-UPSTREAM-LIBPNG-1043612 · WEB
oracle.com/security-alerts/cpuApr2021.html · WEB
oracle.com/security-alerts/cpuoct2021.html · WEB
security.netapp.com/advisory/ntap-20221028-0001 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free