CVE-2023-43907

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at...

7.8 HighFix available

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.46%Up 0.4 points since Oct 1, 2023

What each source reports

NVD Score used 7.8

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: CVE-2023-43907
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

CVE List 7.8

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: CVE-2023-43907
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

EUVDEUVD-2023-48267 7.8

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: EUVD-2023-48267
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xwf2-9m25-2hpf 7.8

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at...

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: GHSA-xwf2-9m25-2hpf
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

OSVALPINE-CVE-2023-43907 7.8

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: ALPINE-CVE-2023-43907
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVAZL-36971 7.8

CVE-2023-43907 affecting package optipng for versions less than 0.7.8-5

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: AZL-36971
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVAZL-37153 7.8

CVE-2023-43907 affecting package optipng 0.7.7-7

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: AZL-37153
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: CVE-2023-43907
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-43907 7.8

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: DEBIAN-CVE-2023-43907
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2023-1873 7.8

optipng security update

OptiPNG is a PNG optimizer that recompresses image files to a smaller size, without losing any information. This program also converts external formats (BMP, GIF, PNM and TIFF) to optimized PNG, and performs PNG integrity checks and corrections.

Security Fix(es):

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.(CVE-2023-43907)

Record: OESA-2023-1873
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-43907 7.8

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Record: UBUNTU-CVE-2023-43907
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2023-0333 No score

Updated optipng packages fix a security vulnerability

Updated the optipng package to fix a security vulnerability (CVE-2023-43907) and other bugs. The GIF handler was vulnerable to a global buffer overflow.

Record: MGASA-2023-0333
Updated: 2026-11-02

OSVopenSUSE-SU-2023:0388-1 No score

Security update for optipng

This update for optipng fixes the following issues:

Update to 0.7.8:

CVE-2023-43907: Fixed a global-buffer-overflow vulnerability in the GIF reader (boo#1215937).
Fixed a stack-print-after-scope defect in the error handler.
Fixed an assertion failure in the image reduction module.
Fixed the command-line wildargs expansion in the Windows port.
Refactored the structured exception handling.

Record: openSUSE-SU-2023:0388-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13415-1 No score

optipng-0.7.8-1.1 on GA media

These are all security issues fixed in the optipng-0.7.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13415-1
Updated: 2026-11-02

Affected products

optipng project optipng

Affected packages

Affected packages
Package	Affected	Fixed
`optipng` Alpine:v3.18	before 0.7.8-r0	0.7.8-r0
`optipng` Alpine:v3.19	before 0.7.8-r0	0.7.8-r0
`optipng` Alpine:v3.20	before 0.7.8-r0	0.7.8-r0
`optipng` Alpine:v3.21	before 0.7.8-r0	0.7.8-r0
`optipng` Alpine:v3.22	before 0.7.8-r0	0.7.8-r0
`optipng` Alpine:v3.23	before 0.7.8-r0	0.7.8-r0
`optipng` Alpine:v3.24	before 0.7.8-r0	0.7.8-r0
`optipng` Azure Linux:3	before 0.7.8-5	0.7.8-5
`optipng` Azure Linux:2	through 0.7.7-7	None known
`optipng` Debian:12	All versions, plus listed versions 0.7.7-20.7.7-30.7.8+ds-17.9.1+ds-17.9.1+ds-2	None known

Show 16 moreShow less

Affected packages
Package	Affected	Fixed
`optipng` Debian:13	before 0.7.8+ds-1	0.7.8+ds-1
`optipng` Debian:14	before 0.7.8+ds-1	0.7.8+ds-1
`optipng` Mageia:8	before 0.7.8-2.mga8	0.7.8-2.mga8
`optipng` Mageia:9	before 0.7.8-2.mga9	0.7.8-2.mga9
`optipng` openEuler:20.03-LTS-SP1	before 0.7.8-1.oe1	0.7.8-1.oe1
`optipng` openEuler:20.03-LTS-SP3	before 0.7.8-1.oe1	0.7.8-1.oe1
`optipng` openEuler:22.03-LTS	before 0.7.8-1.oe2203sp2	0.7.8-1.oe2203sp2
`optipng` openEuler:22.03-LTS-SP1	before 0.7.8-1.oe2203sp1	0.7.8-1.oe2203sp1
`optipng` openEuler:22.03-LTS-SP2	before 0.7.8-1.oe2203sp2	0.7.8-1.oe2203sp2
`optipng` Ubuntu:16.04:LTS	All versions, plus listed versions 0.7.5-10.7.6-10.7.6-1ubuntu0.16.04.1	None known
`optipng` Ubuntu:18.04:LTS	All versions, plus listed versions 0.7.6-1build10.7.6-1ubuntu10.7.6-1.1	None known
`optipng` Ubuntu:20.04:LTS	All versions, plus listed versions 0.7.7-1	None known
`optipng` Ubuntu:22.04:LTS	All versions, plus listed versions 0.7.7-1build10.7.7-20.7.7-2build1	None known
`optipng` SUSE:Package Hub 15 SP4	before 0.7.8-bp154.3.5.1	0.7.8-bp154.3.5.1
`optipng` openSUSE:Leap 15.4	before 0.7.8-bp154.3.5.1	0.7.8-bp154.3.5.1
`optipng` openSUSE:Tumbleweed	before 0.7.8-1.1	0.7.8-1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-43907 is a high vulnerability (CVSS 7.8) in Optipng Project Optipng, published October 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in optipng 0.7.8-r0.

References

Show 13 moreShow less