LodePNG CVE-2026-112020

Exploitation requires that the target application actually invoke the lodepng::getFilterTypesInterlaced() utility in lodepng_util.cpp (not the standard lodepng_decode path) on an attacker-controlled interlaced PNG, and that this PNG declare a raster larger than its decompressed IDAT stream so the unchecked read runs past buffer bounds. Limiting factors: the vector is local (AV:L) and needs the victim to supply/open the crafted file (UI:P), the vulnerable code is a non-core helper so most applications using only core decoding are unaffected, and impact is confined to limited heap-memory disclosure plus denial of service - there is no code execution or integrity impact.

This is a moderate-severity, local-vector issue rather than a remote-exploitation priority. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) scores 6.9 and is internally consistent with the description: exploitation is local (the victim application must process an attacker-supplied PNG file), requires passive user interaction (opening/parsing a file), needs no privileges, and yields limited confidentiality loss (adjacent heap disclosure) plus high availability impact (crash). No EPSS score, KEV listing, or explicit POC flag was provided in the input, so there is no public exploit identified at time of analysis - though a detailed third-party technical writeup exists on hackmd describing the short-IDAT OOB read, which lowers the barrier to developing one. A key scoping nuance NOT reflected in the raw score: the flaw lives in getFilterTypesInterlaced() inside lodepng_util.cpp, a utility/analysis helper, NOT in the core LodePNG decode path, so only applications that specifically call this function are affected - this materially narrows real-world exposure below what the bare CVSS implies. Net: real but bounded; prioritize for consumers of lodepng_util.cpp, deprioritize for the many projects that use only the core decoder.

An attacker crafts an interlaced PNG whose header declares raster dimensions larger than the actual decompressed IDAT stream and delivers it to an application that calls lodepng::getFilterTypesInterlaced() (e.g., an image-analysis or forensic tool). When the victim opens the file, the missing bounds check causes reads past the end of the heap buffer, disclosing adjacent heap memory or crashing the process. No public exploit is identified at time of analysis, but a technical writeup detailing the condition is publicly available.