libpng

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 15 Last 12 months Memory corruption in decode 45 % Out-of-bounds read 25 % Integer overflow 20 % Denial of service 10 % Latest advisories Loading the feed Overview libpng is the reference PNG implementation, and it decodes most of the PNGs a Linux system ever sees. Every distribution ships it. Android carries it in external/libpng , and the Qt and GTK stacks read PNG through it, so the parser sits behind a very large amount of software that accepts images from strangers. Fifteen CVEs landed in the last twelve months, the worst scoring 8.1. Chrome used to be the one place a libpng bug could earn money, and that closed when the browser moved PNG decoding to a Rust implementation and marked the C library neither security-critical nor shipped. sorona.xyz pays you directly on qualified, reproduced findings. In scope libpng publishes no security policy and declares no scope. The private advisory channel on pnggroup/libpng is enabled and worked, and in practice it takes security defects anywhere in the upstream tree The whole read path: chunk dispatch and length handling, IHDR geometry, PLTE and tRNS , the compressed text chunks zTXt and iTXt , iCCP profile handling, eXIf , sPLT and the unknown-chunk machinery Interlace handling and Adam7 de-interlacing, where row arithmetic changes per pass The transformation layer applied during read: palette expansion, bit-depth scaling, gamma correction, background composition, alpha handling and channel stripping The zlib wiring, covering inflate window setup, chunk size limits and the malloc caps libpng applies before handing data to the decompressor The progressive reader ( png_process_data and friends), which parses partial input and is what streaming callers use The simplified API introduced in 1.6 ( png_image_begin_read_* and png_image_finish_read ), which many downstream projects reach for because it is short The write and encode path, including callers that hand libpng attacker-influenced pixel data or text chunks to serialise Error handling and the setjmp/longjmp contract, including anything left inconsistent when a read is abandoned mid-chunk The bundled utilities and contrib code, pngfix , pngtest and the tools that ship in the tree Out of scope The Rust png crate Chrome now uses. Different codebase, different project, no relationship to this tree zlib defects, unless libpng's own use of zlib is what makes them reachable Distribution-specific patches and packaging rather than upstream libpng Downstream consumers that link libpng, such as ImageMagick, Qt and GTK, which are maintained elsewhere Reports filed as public GitHub issues or posted to the png-mng-implement list, which puts the finding in the open before a fix exists Most-valued findings Memory corruption reachable from an ordinary decode of an attacker-supplied file, with no unusual API use by the caller. For calibration, the top score of the last twelve months is CVE-2026-25646 at 8.1 Integer overflow in row, stride or allocation arithmetic derived from IHDR dimensions and bit depth, where a legal-looking header produces an undersized buffer Defects in the compressed ancillary chunks. zTXt , iTXt and iCCP all combine attacker-chosen lengths with decompression, and CVE-2026-33636 at 7.6 and CVE-2026-33416 at 7.5 mark the severity band this surface reaches Anything in the progressive reader that mishandles a chunk split across buffer boundaries, since that path is only exercised by streaming callers and gets less fuzzing Out-of-bounds reads that reach the output image, because the leaked bytes end up in a file the attacker gets back from a thumbnailing service Bugs in the simplified API, which downstream projects adopt precisely because it hides the detail, so a defect there propagates into callers who never look at it Unbounded allocation or non-terminating work from a small input, which turns an upload endpoint into a denial of service Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately with the "Report a vulnerability" control at github.com/pnggroup/libpng/security/advisories/new. The channel is enabled on the repository and the maintainer publishes advisories out of it Do not send an unfixed memory-safety bug to [email protected] . It is the only other documented contact and it is a public mailing list There is no SECURITY.md, so no embargo window and no response target are written down anywhere. State the timeline you want in the report rather than assuming one Reproduce against current upstream 1.6.x rather than a distribution's patched copy, and say which build options were on Attach the PNG that triggers it. A chunk-level description without the file costs the maintainer the reproduction step and slows the advisory Published advisories credit reporters by name, so say how you want to be credited when you file Chrome no longer ships this code. Routing a libpng finding into the Chromium VRP expecting a reward will not work Disclosure Coordinated through GitHub private vulnerability reporting and published as a GitHub Security Advisory alongside a release. Twelve advisories came out in roughly nine months, so the pipeline moves. Because no policy document exists there is no stated embargo and no acknowledgement commitment, and the publication date is something to agree inside the advisory thread. Distributions rebase on upstream releases quickly once an advisory lands, so expect the practical window to close on the release rather than on a day count. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability