CVE-2026-112020

MEDIUM 6.1

LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.

CWE	CWE-125
Vendor	lvandeve
Product	lodepng
Published	Oct 18, 2026

Stay Ahead of the Next One

Get instant alerts for lvandeve lodepng

Be the first to know when new medium vulnerabilities affecting lvandeve lodepng are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

lvandeve / lodepng

0 ≤ 20261006

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@haindpwn/lodepng-getfiltertypesinterlaced-short-idat-oob-read github.com: https://github.com/lvandeve/lodepng/blob/e584a8490db1b76b81bf298c11c09d3b55d9c270/lodepng_util.cpp#L185-L203 github.com: https://github.com/lvandeve/lodepng vulncheck.com: https://www.vulncheck.com/advisories/lodepng-through-20261006-heap-out-of-bounds-read-via-getfiltertypesinterlaced

Credits

HaiND from the Post and Telecommunication Institute of Technology