CVE-2014-0333 Denial of service in n/a
Remote attackers can cause a denial of service via infinite loop in libpng progressive decoder using zero-length IDAT chunks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0333?
CVE-2014-0333 is a medium-severity denial of service vulnerability in Libpng Libpng, published on 27 Feb 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.
Weakness: CWE-189
Which versions are affected by CVE-2014-0333?
It affects 1 product.
Products include Libpng Libpng.
How do I fix CVE-2014-0333?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2014-0333 being exploited?
There is no known exploitation of CVE-2014-0333 in the wild and no public exploit code.
Other vulnerabilities in Libpng Libpng
- CVE-2017-12652 Denial of service in n/a
- CVE-2018-14550 Out-of-bounds write in libpng
- CVE-2026-25646 LIBPNG has a heap buffer overflow in png_set_quantize
- CVE-2026-33636 LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64
- CVE-2026-33416 LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`
Sources
Also known as DEBIAN-CVE-2014-0333, GHSA-fpgr-xxq4-wvw4, MGASA-2014-0131.