CVE-2026-40930

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "= 1.8.0"
                },
                {
                    "last_affected": "= 1.8.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40930.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-436"
    ]
}

References

Affected packages

Git / github.com/pnggroup/libpng

Affected ranges

Type

GIT

Repo

https://github.com/pnggroup/libpng

Events

Introduced

640204280f8109d7165f95d2b177f89baf20b253

Fixed

faf06924688b62d7c1654b5ceddedbde66ffadb4

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.6.49"
        },
        {
            "last_affected": "1.6.57"
        }
    ]
}

Database specific

vanir_signatures_modified

"2026-07-09T19:10:15Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40930.json"

vanir_signatures

[
    {
        "id": "CVE-2026-40930-14856cc1",
        "digest": {
            "function_hash": "144673440958953719761154182473790846714",
            "length": 4325.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4",
        "deprecated": false,
        "target": {
            "function": "png_push_read_chunk",
            "file": "pngpread.c"
        }
    },
    {
        "id": "CVE-2026-40930-2307209e",
        "digest": {
            "line_hashes": [
                "197323092842031073201390913081667206490",
                "202959400792589956914179873667983477952",
                "144917477310186507814180814534047581261",
                "190257526472458430569714277696453300533",
                "84040318123491225829240538646692788632",
                "129218936061640906444022562715472554236",
                "129528312322026917897178854845282932422",
                "37820145241842126207101685129454812231",
                "78961942754562943394822510439719954273",
                "196095510308177636409632698309757601074",
                "84799583870352526161340373968382366410",
                "47488884107565669737411132091470003579",
                "182932716117251733879162354702514039827",
                "233279476753625784877383572881187739954",
                "143076384264035924123021328242815094762",
                "202959400792589956914179873667983477952",
                "144917477310186507814180814534047581261",
                "190257526472458430569714277696453300533",
                "12294371810708319026067743461175731065",
                "113170789474771382969940480237776322072",
                "202355712749907007346272258717794627609",
                "235730107092999585709849120335896828264",
                "179908050492936323167839858144985423897",
                "242147101917022807773546036972565746562",
                "178806628051258797982142989980081284190"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4",
        "deprecated": false,
        "target": {
            "file": "pngpread.c"
        }
    }
]