CVE-2026-40930 LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body
Attackers can exploit a chunk smuggling flaw in the APNG parser to cause memory corruption or crashes by sending malicious PNG files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40930?
CVE-2026-40930 is a medium-severity vulnerability in pnggroup libpng, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.
Weakness: CWE-436
Which versions are affected by CVE-2026-40930?
Linux distribution packages (4)
libpng Red Hat:hummingbird:1 | All versions | 0:1.6.58-1.hum1 |
libpng-devel Red Hat:hummingbird:1 | All versions | 0:1.6.58-1.hum1 |
libpng-static Red Hat:hummingbird:1 | All versions | 0:1.6.58-1.hum1 |
libpng-tools Red Hat:hummingbird:1 | All versions | 0:1.6.58-1.hum1 |
How do I fix CVE-2026-40930?
Apply the vendor's patch.
Is CVE-2026-40930 being exploited?
There is no known exploitation of CVE-2026-40930 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-40930, AZL-89501, AZL-89504, AZL-89507, AZL-89513, AZL-89516 and 11 more.