Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-3713

5.3 MEDIUM

CVSS version: 3.1
Attack vector (AV):
Attack complexity (AC):
Privileges required (PR):
User interaction (UI):
Scope (S):
Confidentiality impact (C):
Integrity impact (I):
Availability impact (A):

created 1 month ago

pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow

A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

VDB-349658 | pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow vdb-entrytechnical-description
VDB-349658 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
Submit #761996 | libpng pnm2png 1.8.0 Integer Overflow to Buffer Overflow third-party-advisory
https://github.com/pnggroup/libpng/issues/794 issue-tracking
https://github.com/biniamf/pocs/tree/main/pnm2png exploit
https://github.com/pnggroup/libpng/ product

Affected products

libpng

Matching in nixpkgs

pkgs.libpng

Official reference implementation for the PNG file format with animation patch

nixos-unstable 1.6.55
- nixpkgs-unstable 1.6.55
- nixos-unstable-small 1.6.55
nixos-25.11 1.6.55
- nixos-25.11-small 1.6.55
- nixpkgs-25.11-darwin 1.6.54

pkgs.libpng12

Official reference implementation for the PNG file format

nixos-unstable 1.2.59
- nixpkgs-unstable 1.2.59
- nixos-unstable-small 1.2.59
nixos-25.11 1.2.59
- nixos-25.11-small 1.2.59
- nixpkgs-25.11-darwin 1.2.59

pkgs.perlPackages.ImagePNGLibpng

Perl interface to libpng

nixos-unstable 0.59
- nixpkgs-unstable 0.59
- nixos-unstable-small 0.59
nixos-25.11 0.59
- nixos-25.11-small 0.59
- nixpkgs-25.11-darwin 0.59

pkgs.perl5Packages.ImagePNGLibpng

Perl interface to libpng

nixos-unstable 0.59
- nixpkgs-unstable 0.59
- nixos-unstable-small 0.59

pkgs.perl538Packages.ImagePNGLibpng

Perl interface to libpng

nixos-25.11 0.59
- nixos-25.11-small 0.59
- nixpkgs-25.11-darwin 0.59

pkgs.perl540Packages.ImagePNGLibpng

Perl interface to libpng

nixos-25.11 0.59
- nixos-25.11-small 0.59
- nixpkgs-25.11-darwin 0.59

pkgs.tests.pkg-config.defaultPkgConfigPackages.libpng

Test whether libpng-apng-1.6.46 exposes pkg-config modules libpng

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small
nixos-25.11 -
- nixos-25.11-small
- nixpkgs-25.11-darwin

Package maintainers

@vcunat Vladimír Čunát <v@cunat.cz>