CVE-2026-40930

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-436"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40930.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "= 1.8.0"
                        },
                        {
                            "last_affected":  "= 1.8.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/pnggroup/libpng

Affected ranges

Type

GIT

Repo

https://github.com/pnggroup/libpng

Events

Introduced

640204280f8109d7165f95d2b177f89baf20b253

Fixed

faf06924688b62d7c1654b5ceddedbde66ffadb4

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.6.49"
                },
                {
                    "last_affected":  "1.6.57"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "faf06924688b62d7c1654b5ceddedbde66ffadb4"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40930.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "144673440958953719761154182473790846714",
            "length":  4325
        },
        "id":  "CVE-2026-40930-14856cc1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4",
        "target":  {
            "file":  "pngpread.c",
            "function":  "png_push_read_chunk"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "197323092842031073201390913081667206490",
                "202959400792589956914179873667983477952",
                "144917477310186507814180814534047581261",
                "190257526472458430569714277696453300533",
                "84040318123491225829240538646692788632",
                "129218936061640906444022562715472554236",
                "129528312322026917897178854845282932422",
                "37820145241842126207101685129454812231",
                "78961942754562943394822510439719954273",
                "196095510308177636409632698309757601074",
                "84799583870352526161340373968382366410",
                "47488884107565669737411132091470003579",
                "182932716117251733879162354702514039827",
                "233279476753625784877383572881187739954",
                "143076384264035924123021328242815094762",
                "202959400792589956914179873667983477952",
                "144917477310186507814180814534047581261",
                "190257526472458430569714277696453300533",
                "12294371810708319026067743461175731065",
                "113170789474771382969940480237776322072",
                "202355712749907007346272258717794627609",
                "235730107092999585709849120335896828264",
                "179908050492936323167839858144985423897",
                "242147101917022807773546036972565746562",
                "178806628051258797982142989980081284190"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-40930-2307209e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4",
        "target":  {
            "file":  "pngpread.c"
        }
    }
]

vanir_signatures_modified

"2026-10-22T17:03:46Z"