ECHO-191b-44fe-7772
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-191b-44fe-7772.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-191b-44fe-7772
- Upstream
- Withdrawn
- 2026-09-27T11:30:04Z
- Published
- 2026-07-25T20:56:58Z
- Modified
- 2026-09-27T12:15:03Z
- Summary
- Heap out-of-bounds write in the native PNG/APNG encoder when writing a crafted eXIf chunk (add_exif_profile_size() underestimates the sanitized IFD size). The eXIf-writing code does not exist in this source: libavcodec/pngenc.c at n7.1.5 (and on the release/7.1 branch) has no EXIF/IFD handling at all; it was added in the 8.x series, which is why the CVE range reads "through 8.1.2". Upstream fix b506fafe cannot apply here because the code it patches is absent. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-66040 - https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc details: | If this spec is ever bumped to a version whose pngenc.c writes eXIf chunks (8.1+), this entry MUST be re-evaluated and converted into a real PATCH_TYPE_UPSTREAM_PATCH entry.
- Details
- References