Executive Summary

This vulnerability is a heap buffer over-read in the libpng library's png_do_quantize function. It happens when processing PNG files that have malformed palette indices. Specifically, the function does not properly check the bounds of the palette_lookup array against the image data, allowing an attacker to craft a PNG file with out-of-range palette indices that cause out-of-bounds memory access.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to out-of-bounds memory access, which may cause a program using libpng to crash or behave unpredictably. This can result in denial of service or potentially allow an attacker to read sensitive memory contents, depending on the context in which libpng is used.

Useful 0 Not Useful 0

Mitigation Strategies

Update libpng to version 1.6.51 or later, as this version contains the patch for the heap buffer over-read vulnerability in the png_do_quantize function. Avoid processing untrusted or malformed PNG files until the update is applied.

Useful 0 Not Useful 0