{"id":"CVE-2026-112020","aliases":["EUVD-2026-103473","GHSA-245m-8wv4-4xg8"],"status":"published","title":"LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()","description":"LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00187,"percentile":0.08413,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2026-10-18T11:38:39Z","modified":"2026-10-22T03:33:28Z","products":[{"vendor":"lvandeve","product":"lodepng"}],"references":[{"url":"https://hackmd.io/@haindpwn/lodepng-getfiltertypesinterlaced-short-idat-oob-read","tags":["technical-description"]},{"url":"https://github.com/lvandeve/lodepng/blob/e584a8490db1b76b81bf298c11c09d3b55d9c270/lodepng_util.cpp#L185-L203","tags":["technical-description"]},{"url":"https://github.com/lvandeve/lodepng","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/lodepng-through-20261006-heap-out-of-bounds-read-via-getfiltertypesinterlaced","tags":["third-party-advisory"]},{"url":"https://hackmd.io/@haindpwn/cve-2026-112020-lodepng-getfiltertypesinterlaced-short-idat-oob-read","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112020"},{"url":"https://github.com/advisories/GHSA-245m-8wv4-4xg8"}],"sources":{"cve":[{"id":"CVE-2026-112020","title":"LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()","description":"LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.","status":"published","published":"2026-10-18T11:38:39.921Z","modified":"2026-10-22T02:15:36.959Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:44:40.64332Z"}],"euvd":[{"id":"EUVD-2026-103473","description":"LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.","status":"published","published":"2026-10-18T11:38:39Z","modified":"2026-10-22T02:15:36Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:35.538537Z"}],"ghsa":[{"id":"GHSA-245m-8wv4-4xg8","title":"LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng:...","description":"LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.","status":"published","published":"2026-10-18T12:30:28Z","modified":"2026-10-22T03:33:28Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:14:14.973906Z"}],"nvd":[{"id":"CVE-2026-112020","description":"LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.","status":"published","published":"2026-10-18T12:17:15.067Z","modified":"2026-10-22T03:16:33.11Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:13:00.123071Z"}]}}