CVE-2026-40930

MediumCVSS 5.4/10Last modified Jul 22, 2026

Description

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-436

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
pnggrouplibpng= 1.8.0
pnggrouplibpng-apng>= 1.6.49, <= 1.6.57

References

Timeline

Published
Jun 4, 2026
Last modified
Jul 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-409317.8Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logiCVE-2026-409339.9Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdiCVE-2026-409346.8Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies iCVE-2026-409355.3WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directlCVE-2026-409378.3RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rCVE-2026-409388.5Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1CVE-2026-409396.8The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-aCVE-2026-40948.1The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capabCVE-2026-409416.5Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypCVE-2026-409426.3The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OICVE-2026-409438.7Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closureCVE-2026-409446.9Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the f