CVE-2002-0728

Buffer overflow in the progressive reader for libpng 1.2.x before 1.2.4, and 1.0.x before 1.0.14,...

5.0 MediumFix available

CVE-2002-0728 is a medium vulnerability (CVSS 5.0) in Greg Roelofs Libpng, published July 26, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.09%, the 81st percentile. Fixed in libpng 1.0.12-3.woody.2.

Buffer overflow in the progressive reader for libpng 1.2.x before 1.2.4, and 1.0.x before 1.0.14, allows attackers to cause a denial of service (crash) via a PNG data stream that has more IDAT data than indicated by the IHDR chunk.

Exploit likelihood

2.09%Up 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2002-0728
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2002-0728
Updated: 2026-11-02

EUVDEUVD-2002-0720 No score

Record: EUVD-2002-0720
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hm75-38g4-x8xm No score

Buffer overflow in the progressive reader for libpng 1.2.x before 1.2.4, and 1.0.x before 1.0.14,...

Record: GHSA-hm75-38g4-x8xm
Updated: 2026-11-02

Affected products

greg roelofs libpng

Affected packages

Affected packages
Package	Affected	Fixed
`libpng` Debian:3.0	before 1.0.12-3.woody.2	1.0.12-3.woody.2
`libpng3` Debian:3.0	before 1.2.1-1.1.woody.2	1.2.1-1.1.woody.2

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV