Every CVE Search/ Get API key

CVE-2009-2042

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are...

4.3 MediumFix available

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Exploit likelihood

2.28%Down 1.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Record
CVE-2009-2042
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Record
CVE-2009-2042
Updated
2026-11-02
EUVDEUVD-2009-2038 No score

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Record
EUVD-2009-2038
Updated
2026-11-03
GitHub AdvisoriesGHSA-rh45-m734-j52q No score

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are...

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Record
GHSA-rh45-m734-j52q
Weakness
CWE-200
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libpng
Debian:5.0
 before 1.2.27-2+lenny3, plus listed versions
1.2.27-21.2.27-2+lenny2
1.2.27-2+lenny3
libpng
Red Hat:enterprise_linux:3::as
 before 2:1.2.2-30
2:1.2.2-30
libpng-debuginfo
Red Hat:enterprise_linux:3::as
 before 2:1.2.2-30
2:1.2.2-30
libpng-devel
Red Hat:enterprise_linux:3::as
 before 2:1.2.2-30
2:1.2.2-30
libpng10
Red Hat:enterprise_linux:3::as
 before 0:1.0.13-21
0:1.0.13-21
libpng10-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:1.0.13-21
0:1.0.13-21
libpng10-devel
Red Hat:enterprise_linux:3::as
 before 0:1.0.13-21
0:1.0.13-21
libpng
Red Hat:enterprise_linux:3::desktop
 before 2:1.2.2-30
2:1.2.2-30
libpng-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 2:1.2.2-30
2:1.2.2-30
libpng-devel
Red Hat:enterprise_linux:3::desktop
 before 2:1.2.2-30
2:1.2.2-30
Show 48 moreShow less
Affected packages
PackageAffectedFixed
libpng10
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.13-21
0:1.0.13-21
libpng10-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.13-21
0:1.0.13-21
libpng10-devel
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.13-21
0:1.0.13-21
libpng
Red Hat:enterprise_linux:3::es
 before 2:1.2.2-30
2:1.2.2-30
libpng-debuginfo
Red Hat:enterprise_linux:3::es
 before 2:1.2.2-30
2:1.2.2-30
libpng-devel
Red Hat:enterprise_linux:3::es
 before 2:1.2.2-30
2:1.2.2-30
libpng10
Red Hat:enterprise_linux:3::es
 before 0:1.0.13-21
0:1.0.13-21
libpng10-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:1.0.13-21
0:1.0.13-21
libpng10-devel
Red Hat:enterprise_linux:3::es
 before 0:1.0.13-21
0:1.0.13-21
libpng
Red Hat:enterprise_linux:3::ws
 before 2:1.2.2-30
2:1.2.2-30
libpng-debuginfo
Red Hat:enterprise_linux:3::ws
 before 2:1.2.2-30
2:1.2.2-30
libpng-devel
Red Hat:enterprise_linux:3::ws
 before 2:1.2.2-30
2:1.2.2-30
libpng10
Red Hat:enterprise_linux:3::ws
 before 0:1.0.13-21
0:1.0.13-21
libpng10-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:1.0.13-21
0:1.0.13-21
libpng10-devel
Red Hat:enterprise_linux:3::ws
 before 0:1.0.13-21
0:1.0.13-21
libpng
Red Hat:enterprise_linux:4::as
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-debuginfo
Red Hat:enterprise_linux:4::as
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-devel
Red Hat:enterprise_linux:4::as
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng10
Red Hat:enterprise_linux:4::as
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-devel
Red Hat:enterprise_linux:4::as
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng
Red Hat:enterprise_linux:4::desktop
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-devel
Red Hat:enterprise_linux:4::desktop
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng10
Red Hat:enterprise_linux:4::desktop
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-devel
Red Hat:enterprise_linux:4::desktop
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng
Red Hat:enterprise_linux:4::es
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-debuginfo
Red Hat:enterprise_linux:4::es
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-devel
Red Hat:enterprise_linux:4::es
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng10
Red Hat:enterprise_linux:4::es
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-devel
Red Hat:enterprise_linux:4::es
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng
Red Hat:enterprise_linux:4::ws
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-debuginfo
Red Hat:enterprise_linux:4::ws
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-devel
Red Hat:enterprise_linux:4::ws
 before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng10
Red Hat:enterprise_linux:4::ws
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-devel
Red Hat:enterprise_linux:4::ws
 before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng
Red Hat:enterprise_linux:5::client_workstation
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-devel
Red Hat:enterprise_linux:5::client_workstation
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng
Red Hat:enterprise_linux:5::client
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-debuginfo
Red Hat:enterprise_linux:5::client
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-devel
Red Hat:enterprise_linux:5::client
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng
Red Hat:enterprise_linux:5::server
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-debuginfo
Red Hat:enterprise_linux:5::server
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-devel
Red Hat:enterprise_linux:5::server
 before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-2042 is a medium vulnerability (CVSS 4.3) in Libpng, published June 12, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. Fixed in libpng 1.2.27-2+lenny3.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open