CVE-2014-9495

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x...

10.0 HighPublic exploitFix available

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.

Exploit likelihood

4.05%Up 0.8 points since Feb 4, 2022

What each source reports

CVE List 8.8

Record: CVE-2014-9495
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2014-9312 8.8

Record: EUVD-2014-9312
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wpr3-pfv2-chjq 8.8

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x...

Record: GHSA-wpr3-pfv2-chjq
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119, CWE-122
Updated: 2026-11-02

NVD 8.8

Record: CVE-2014-9495
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-119, CWE-122
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-9495 8.8

Record: DEBIAN-CVE-2014-9495
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV No score

Record: CVE-2014-9495
Updated: 2026-11-02

OSVMGASA-2015-0008 No score

Updated libpng packages fix CVE-2014-9495

Updated libpng packages fix security vulnerability:

libpng versions 1.6.9 through 1.6.15 have an integer-overflow vulnerability in png_combine_row() when decoding very wide interlaced images, which can allow an attacker to overwrite an arbitrary amount of memory with arbitrary (attacker-controlled) data (CVE-2014-9495).

Record: MGASA-2015-0008
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10184-1 No score

libpng12-0-1.2.56-1.5 on GA media

These are all security issues fixed in the libpng12-0-1.2.56-1.5 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10184-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libpng1.6` Debian:12	before 1.6.16-1	1.6.16-1
`libpng1.6` Debian:13	before 1.6.16-1	1.6.16-1
`libpng1.6` Debian:14	before 1.6.16-1	1.6.16-1
`texlive-bin` Debian:12	before 2014.20140926.35254-4	2014.20140926.35254-4
`texlive-bin` Debian:13	before 2014.20140926.35254-4	2014.20140926.35254-4
`texlive-bin` Debian:14	before 2014.20140926.35254-4	2014.20140926.35254-4
`libpng` Mageia:4	before 1.6.16-1.mga4	1.6.16-1.mga4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	Enessar/LibPNG_OSS-Fuzz	2025-10-25

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 2, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9495 is a high vulnerability (CVSS 10.0) in Libpng, published January 7, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.05%, the 90th percentile. Fixed in libpng1.6 1.6.16-1.

References

Show 23 moreShow less