CVE-2026-112020
LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
lvandeve lodepng
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 22 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.
Text from CVE List
Affected versions 1
- lodepngaffected: all versions through 20261006CVE List
References 5
- vulncheck.com/advisories/lodepng-through-20261006-heap-out-of-bounds-read-via-getfiltertypesinterlacedAdvisoryvia CVE List
- hackmd.io/@haindpwn/cve-2026-112020-lodepng-getfiltertypesinterlaced-short-idat-oob-readExploitvia CVE List
- hackmd.io/@haindpwn/lodepng-getfiltertypesinterlaced-short-idat-oob-readReferencevia CVE List
- github.com/lvandeve/lodepng/blob/e584a8490db1b76b81bf298c11c09d3b55d9c270/lodepng_util.cpp#L185-L203Referencevia CVE List
- github.com/lvandeve/lodepngReferencevia CVE List