CVE-2016-5735

Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow.

References

Affected packages

Git / github.com/kornelski/pngquant

Affected ranges

Type

GIT

Repo

https://github.com/kornelski/pngquant

Events

Introduced

cd14e0881a3e1f8157947e63ffd846c9f7a55c82

Last Affected

cd14e0881a3e1f8157947e63ffd846c9f7a55c82

Fixed

b7c217680cda02dddced245d237ebe8c383be285

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:pngquant:pngquant:2.7.0:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "2.7.0"
        },
        {
            "last_affected":  "2.7.0"
        }
    ],
    "source":  [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.7.0

2.7.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5735.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "11749072273354818079652599568515810704",
                "295321760208783322335535339872887592277",
                "263241181405925274193218127026934768670",
                "279570523230507015572632992992007345031",
                "61102045982274863775149249678886770771",
                "101195728603932320435831620322596778343",
                "185264035726705698568741517661172567482",
                "323461216799807688237550986647038251466",
                "59479731129094185246169890485511112403",
                "3248771318875236472868746566677569443"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2016-5735-90d441ae",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/kornelski/pngquant/commit/b7c217680cda02dddced245d237ebe8c383be285",
        "target":  {
            "file":  "rwpng.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "219203256382287797673606922366190072575",
            "length":  4485
        },
        "id":  "CVE-2016-5735-9ffba8c0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/kornelski/pngquant/commit/b7c217680cda02dddced245d237ebe8c383be285",
        "target":  {
            "file":  "rwpng.c",
            "function":  "rwpng_read_image24_libpng"
        }
    }
]

vanir_signatures_modified

"2026-08-27T08:18:22Z"