{"id":"CVE-2026-40930","summary":"LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body","details":"LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.","aliases":["GHSA-c4v6-gxrq-6g2x"],"modified":"2026-09-12T08:14:47.846724Z","published":"2026-06-04T14:34:51.843Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-436"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40930.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"= 1.8.0"},{"last_affected":"= 1.8.0"}]}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/05/15/21"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40930.json"},{"type":"ADVISORY","url":"https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40930"},{"type":"FIX","url":"https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pnggroup/libpng","events":[{"introduced":"640204280f8109d7165f95d2b177f89baf20b253"},{"fixed":"faf06924688b62d7c1654b5ceddedbde66ffadb4"}],"database_specific":{"extracted_events":[{"introduced":"1.6.49"},{"last_affected":"1.6.57"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40930.json","vanir_signatures_modified":"2026-09-12T08:14:47Z","vanir_signatures":[{"source":"https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4","target":{"file":"pngpread.c","function":"png_push_read_chunk"},"deprecated":false,"digest":{"function_hash":"144673440958953719761154182473790846714","length":4325},"id":"CVE-2026-40930-14856cc1","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4","target":{"file":"pngpread.c"},"deprecated":false,"digest":{"line_hashes":["197323092842031073201390913081667206490","202959400792589956914179873667983477952","144917477310186507814180814534047581261","190257526472458430569714277696453300533","84040318123491225829240538646692788632","129218936061640906444022562715472554236","129528312322026917897178854845282932422","37820145241842126207101685129454812231","78961942754562943394822510439719954273","196095510308177636409632698309757601074","84799583870352526161340373968382366410","47488884107565669737411132091470003579","182932716117251733879162354702514039827","233279476753625784877383572881187739954","143076384264035924123021328242815094762","202959400792589956914179873667983477952","144917477310186507814180814534047581261","190257526472458430569714277696453300533","12294371810708319026067743461175731065","113170789474771382969940480237776322072","202355712749907007346272258717794627609","235730107092999585709849120335896828264","179908050492936323167839858144985423897","242147101917022807773546036972565746562","178806628051258797982142989980081284190"],"threshold":0.9},"id":"CVE-2026-40930-2307209e","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}]}