Every CVESearch/Get API key

CVE-2009-2042

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are...

4.3 Medium

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Exploit likelihood

2.28%Down 1.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used4.3

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Record
CVE-2009-2042
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE ListNo score

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Record
CVE-2009-2042
Updated
2026-11-02
EUVDEUVD-2009-2038No score

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Record
EUVD-2009-2038
Updated
2026-11-03
GitHub AdvisoriesGHSA-rh45-m734-j52qNo score

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are...

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

Record
GHSA-rh45-m734-j52q
Weakness
CWE-200
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libpng
Debian:5.0
From an advisory covering 2 CVEs
before 1.2.27-2+lenny3, plus listed versions
1.2.27-21.2.27-2+lenny2
1.2.27-2+lenny3
libpng
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng-debuginfo
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng-devel
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng10
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng10-debuginfo
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng10-devel
Red Hat:enterprise_linux:3::as
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng-debuginfo
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng-devel
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
Show 48 moreShow less
Affected packages
PackageAffectedFixed
libpng10
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng10-debuginfo
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng10-devel
Red Hat:enterprise_linux:3::desktop
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng-debuginfo
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng-devel
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng10
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng10-debuginfo
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng10-devel
Red Hat:enterprise_linux:3::es
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng-debuginfo
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng-devel
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
before 2:1.2.2-30
2:1.2.2-30
libpng10
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng10-debuginfo
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng10-devel
Red Hat:enterprise_linux:3::ws
From an advisory covering 4 CVEs
before 0:1.0.13-21
0:1.0.13-21
libpng
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng10
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng10
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng10
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
before 2:1.2.7-3.el4_8.3
2:1.2.7-3.el4_8.3
libpng10
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng10-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
before 0:1.0.16-3.el4_8.4
0:1.0.16-3.el4_8.4
libpng
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3
libpng-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 2:1.2.10-7.1.el5_5.3
2:1.2.10-7.1.el5_5.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-2042 is a medium vulnerability (CVSS 4.3) in Libpng, published June 12, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. No source names a fixed version.

References

Show 41 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open