CVE-2016-5735

Integer overflow in the rwpngreadimage24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow.

References

Affected packages

Git / github.com/kornelski/pngquant

Affected ranges

Type

GIT

Repo

https://github.com/kornelski/pngquant

Events

Introduced

cd14e0881a3e1f8157947e63ffd846c9f7a55c82

Last affected

cd14e0881a3e1f8157947e63ffd846c9f7a55c82

Fixed

b7c217680cda02dddced245d237ebe8c383be285

Database specific

Show details

{
    "cpe": "cpe:2.3:a:pngquant:pngquant:2.7.0:*:*:*:*:*:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.0"
        }
    ]
}

Affected versions

2.*

2.7.0

2.7.1

Database specific

vanir_signatures

[
    {
        "target": {
            "file": "rwpng.c"
        },
        "deprecated": false,
        "id": "CVE-2016-5735-90d441ae",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "11749072273354818079652599568515810704",
                "295321760208783322335535339872887592277",
                "263241181405925274193218127026934768670",
                "279570523230507015572632992992007345031",
                "61102045982274863775149249678886770771",
                "101195728603932320435831620322596778343",
                "185264035726705698568741517661172567482",
                "323461216799807688237550986647038251466",
                "59479731129094185246169890485511112403",
                "3248771318875236472868746566677569443"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "source": "https://github.com/kornelski/pngquant/commit/b7c217680cda02dddced245d237ebe8c383be285"
    },
    {
        "target": {
            "file": "rwpng.c",
            "function": "rwpng_read_image24_libpng"
        },
        "deprecated": false,
        "id": "CVE-2016-5735-9ffba8c0",
        "signature_version": "v1",
        "digest": {
            "function_hash": "219203256382287797673606922366190072575",
            "length": 4485.0
        },
        "signature_type": "Function",
        "source": "https://github.com/kornelski/pngquant/commit/b7c217680cda02dddced245d237ebe8c383be285"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5735.json"

vanir_signatures_modified

"2026-08-27T08:18:22Z"