libmng EUVD-2026-103461

Exploitation requires an application that links libmng version 2.0.3 or earlier and calls mng_read or mng_readdisplay on untrusted input, plus a victim action to open/process an attacker-crafted MNG file (UI:P) - there is no remote, zero-interaction path. The crafted file must specifically contain an MHDR header, a DHDR chunk, and a multi-record ORDR chunk so that the ORDR entry buffer, allocated based on 5-byte on-wire records, is overrun by the larger 8-byte in-memory entries. Limiting factors: the vector is local/file-based, user interaction is mandatory, and the target must actually route untrusted MNG data through the vulnerable code path; environments that do not process the obsolete MNG format or have upgraded past 2.0.3 are not exposed.

The input CVSS 4.0 base score is 6.9 (Medium) with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H. The dominant impact is availability (VA:H) - a heap corruption that crashes the consuming application - with only low integrity impact (VI:L) and no confidentiality impact (VC:N); despite the CWE-131 buffer-size miscalculation, the provided data describes memory corruption and a crash, not confirmed arbitrary code execution. The vector is local (AV:L) and requires passive user interaction (UI:P), meaning a victim must open or process an attacker-supplied MNG file through an application that calls mng_read or mng_readdisplay - this is not remote, unauthenticated, network-reachable exploitation and is not automatable at scale. Publicly available exploit code exists (a hackmd write-up referenced by VulnCheck), which raises the practical likelihood of reliable crash reproduction, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active in-the-wild exploitation. EPSS is missing from the input and cannot be assessed; its absence is not evidence either way. Net assessment: a real but moderate-priority memory-safety bug - the public POC and clear root cause justify patching, but the local/user-interaction requirement and crash-dominant (rather than RCE-confirmed) impact keep this well below emergency priority.

An attacker crafts a malicious MNG image containing MHDR, DHDR, and a multi-record ORDR chunk and delivers it to a victim (e.g., via email, web content, or a file share). When the victim opens the file in an application that uses libmng ≤2.0.3 and calls mng_read or mng_readdisplay, the undersized ORDR buffer is overwritten past its allocation, corrupting the heap and crashing the application. A public proof-of-concept write-up demonstrating the out-of-bounds write already exists.