Every CVE Search/ Get API key

CVE-2020-35511

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied)...

7.8 HighFix available

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.36%Down 0.5 points since Aug 24, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

Record
CVE-2020-35511
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-126, CWE-119
Updated
2026-11-02
CVE List No score

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

Record
CVE-2020-35511
Weakness
CWE-126
Updated
2026-11-02
EUVDEUVD-2020-23178 No score

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

Record
EUVD-2020-23178
Updated
2026-11-03
GitHub AdvisoriesGHSA-4p54-36pq-7qrc 7.8

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied)...

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

Record
GHSA-4p54-36pq-7qrc
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-119, CWE-126
Updated
2026-11-02
OSV 7.8

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

Record
CVE-2020-35511
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2020-35511 7.8

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

Record
DEBIAN-CVE-2020-35511
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-35511 7.8

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

Record
UBUNTU-CVE-2020-35511
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2022:10142-1 No score

Security update for pngcheck

This update for pngcheck fixes the following issues:

version update to 3.0.3 [boo#1202662]

  • fixed a crash bug (and probable vulnerability) in large (MNG) LOOP chunks
  • fixed a divide-by-zero crash bug (and probable vulnerability) in interlaced images with extra compressed data beyond the nominal end of the image data (found by 'chiba of topsec alpha lab')

version update to 3.0.0

  • tweaked color definitions slightly to work better on terminals with white/light backgrounds
  • fixed DHDR (pre-MNG-1.0) bug identified by Winfried [email protected]
  • added eXIf support (GRR: added check for II/MM/unknown format)
  • converted static const help/usage-related strings to macros so -Werror=format-security doesn't trigger (Ben Beasley)
  • added (help2man-generated) man pages for all three utils added top-level LICENSE file; fixed various compiler warnings
  • fixed buffer-overflow vulnerability discovered by 'giantbranch of NSFOCUS Security Team' * https://bugzilla.redhat.com/show_bug.cgi?id=1897485
  • found and fixed four additional vulnerabilities (null-pointer dereference and three buffer overruns)
  • an off-by-one bug in check_magic() (Lucy Phipps)
  • converted two zlib-version warnings/errors to go to stderr (Lemures Lemniscati, actually from 20180318; forwarded by LP)
  • fixed another buffer-overflow vulnerability discovered by 'giantbranch of NSFOCUS Security Team' https://bugzilla.redhat.com/show_bug.cgi?id=1905775
  • removed -f ('force') option due to multiple security issues
Record
openSUSE-SU-2022:10142-1
Updated
2026-11-02
OSVUSN-6182-1 No score

pngcheck vulnerabilities

It was discovered that pngcheck incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.

Record
USN-6182-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pngcheck
Debian:12
 before 3.0.2-2
3.0.2-2
pngcheck
Debian:13
 before 3.0.2-2
3.0.2-2
pngcheck
Debian:14
 before 3.0.2-2
3.0.2-2
pngcheck
Debian:10
 before 3.0.3-1~deb10u2, plus listed versions
2.3.0-102.3.0-112.3.0-122.3.0-132.3.0-7
Show 7 moreShow less
2.3.0-7+deb10u12.3.0-82.3.0-93.0.2-13.0.2-23.0.2-33.0.2-4
3.0.3-1~deb10u2
pngcheck
Debian:11
 before 3.0.3-1~deb11u1, plus listed versions
2.3.0-133.0.2-13.0.2-23.0.2-33.0.2-43.0.3-1~deb10u2
3.0.3-1~deb11u1
pngcheck
Ubuntu:Pro:16.04:LTS
 before 2.3.0-7ubuntu0.16.04.1~esm1, plus listed versions
2.3.0-7
2.3.0-7ubuntu0.16.04.1~esm1
pngcheck
Ubuntu:Pro:18.04:LTS
 before 2.3.0-7ubuntu0.18.04.1~esm1, plus listed versions
2.3.0-7
2.3.0-7ubuntu0.18.04.1~esm1
pngcheck
Ubuntu:20.04:LTS
 before 2.3.0-7ubuntu0.20.04.1, plus listed versions
2.3.0-7
2.3.0-7ubuntu0.20.04.1
pngcheck
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.0.3-3
 None known
pngcheck
Ubuntu:25.10
 All versions, plus listed versions
3.0.3-3
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
pngcheck
Ubuntu:26.10
 All versions, plus listed versions
4.0.1-1
 None known
pngcheck
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.3-34.0.0+git20250707.6419815-14.0.1-1
 None known
pngcheck
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 2.3.0-7ubuntu0.16.04.1~esm1, plus listed versions
2.3.0-7
2.3.0-7ubuntu0.16.04.1~esm1
pngcheck
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 2.3.0-7ubuntu0.18.04.1~esm1, plus listed versions
2.3.0-7
2.3.0-7ubuntu0.18.04.1~esm1
pngcheck
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 2.3.0-7ubuntu0.20.04.1, plus listed versions
2.3.0-7
2.3.0-7ubuntu0.20.04.1
pngcheck
SUSE:Package Hub 15 SP3
 before 3.0.3-bp153.3.3.1
3.0.3-bp153.3.3.1
pngcheck
openSUSE:Leap 15.3
 before 3.0.3-bp153.3.3.1
3.0.3-bp153.3.3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD, OSV
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-35511 is a high vulnerability (CVSS 7.8) in Libpng Pngcheck, published August 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in pngcheck 3.0.2-2.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open