JLSEC-2026-9

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-9.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-9.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-9

Upstream

CVE-2025-28162

Published

2026-03-24T16:21:52.681Z

Modified

2026-07-25T18:24:54.311655215Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of...

Details

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28162",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-28162",
            "published": "2026-01-27T16:16:14.630Z",
            "id": "CVE-2025-28162",
            "imported": "2026-07-17T22:41:16.016Z",
            "modified": "2026-06-17T09:04:37.030Z",
            "database_specific": {
                "status": "Analyzed"
            }
        }
    ]
}

References

Affected packages

Julia / libpng_jll

Package

Name: libpng_jll
Purl: pkg:julia/libpng_jll?uuid=b53b4c65-9356-5827-b1ea-8c7a1a84506f

Affected ranges

Type: SEMVER
Events: Introduced

1.6.43+0

Fixed

1.6.47+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-9.json"