CVE-2026-3713
Estado: AplazadaBaja (1.9)—
A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 1.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.18%
- Percentil entre todas las CVEs puntuadas: 7
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-119, CWE-122
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-3713",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-3713",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-03-11T13:42:50.906724Z"
}
}
],
"cvssMetricV2": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.1,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 1.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 1.9,
"Automatable": "NOT_DEFINED",
"attackVector": "LOCAL",
"baseSeverity": "LOW",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "PROOF_OF_CONCEPT",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "cna@vuldb.com",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*"
],
"vendor": "pnggroup",
"modules": [
"pnm2png"
],
"product": "libpng",
"versions": [
{
"status": "affected",
"version": "1.6.0"
},
{
"status": "affected",
"version": "1.6.1"
},
{
"status": "affected",
"version": "1.6.2"
},
{
"status": "affected",
"version": "1.6.3"
},
{
"status": "affected",
"version": "1.6.4"
},
{
"status": "affected",
"version": "1.6.5"
},
{
"status": "affected",
"version": "1.6.6"
},
{
"status": "affected",
"version": "1.6.7"
},
{
"status": "affected",
"version": "1.6.8"
},
{
"status": "affected",
"version": "1.6.9"
},
{
"status": "affected",
"version": "1.6.10"
},
{
"status": "affected",
"version": "1.6.11"
},
{
"status": "affected",
"version": "1.6.12"
},
{
"status": "affected",
"version": "1.6.13"
},
{
"status": "affected",
"version": "1.6.14"
},
{
"status": "affected",
"version": "1.6.15"
},
{
"status": "affected",
"version": "1.6.16"
},
{
"status": "affected",
"version": "1.6.17"
},
{
"status": "affected",
"version": "1.6.18"
},
{
"status": "affected",
"version": "1.6.19"
},
{
"status": "affected",
"version": "1.6.20"
},
{
"status": "affected",
"version": "1.6.21"
},
{
"status": "affected",
"version": "1.6.22"
},
{
"status": "affected",
"version": "1.6.23"
},
{
"status": "affected",
"version": "1.6.24"
},
{
"status": "affected",
"version": "1.6.25"
},
{
"status": "affected",
"version": "1.6.26"
},
{
"status": "affected",
"version": "1.6.27"
},
{
"status": "affected",
"version": "1.6.28"
},
{
"status": "affected",
"version": "1.6.29"
},
{
"status": "affected",
"version": "1.6.30"
},
{
"status": "affected",
"version": "1.6.31"
},
{
"status": "affected",
"version": "1.6.32"
},
{
"status": "affected",
"version": "1.6.33"
},
{
"status": "affected",
"version": "1.6.34"
},
{
"status": "affected",
"version": "1.6.35"
},
{
"status": "affected",
"version": "1.6.36"
},
{
"status": "affected",
"version": "1.6.37"
},
{
"status": "affected",
"version": "1.6.38"
},
{
"status": "affected",
"version": "1.6.39"
},
{
"status": "affected",
"version": "1.6.40"
},
{
"status": "affected",
"version": "1.6.41"
},
{
"status": "affected",
"version": "1.6.42"
},
{
"status": "affected",
"version": "1.6.43"
},
{
"status": "affected",
"version": "1.6.44"
},
{
"status": "affected",
"version": "1.6.45"
},
{
"status": "affected",
"version": "1.6.46"
},
{
"status": "affected",
"version": "1.6.47"
},
{
"status": "affected",
"version": "1.6.48"
},
{
"status": "affected",
"version": "1.6.49"
},
{
"status": "affected",
"version": "1.6.50"
},
{
"status": "affected",
"version": "1.6.51"
},
{
"status": "affected",
"version": "1.6.52"
},
{
"status": "affected",
"version": "1.6.53"
},
{
"status": "affected",
"version": "1.6.54"
},
{
"status": "affected",
"version": "1.6.55"
}
]
}
]
}
],
"published": "2026-03-08T06:16:11.460",
"references": [
{
"url": "https://github.com/biniamf/pocs/tree/main/pnm2png",
"source": "cna@vuldb.com"
},
{
"url": "https://github.com/pnggroup/libpng/",
"source": "cna@vuldb.com"
},
{
"url": "https://github.com/pnggroup/libpng/issues/794",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.349658",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.349658",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.761996",
"source": "cna@vuldb.com"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"description": [
{
"lang": "en",
"value": "CWE-119"
},
{
"lang": "en",
"value": "CWE-122"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Se ha encontrado una falla en pnggroup libpng hasta 1.6.55. Afectada por esta vulnerabilidad es la función do_pnm2png del archivo contrib/pngminus/pnm2png.c del componente pnm2png. Esta manipulación del argumento width/height causa desbordamiento de búfer basado en montículo. El ataque está restringido a la ejecución local. El exploit ha sido publicado y puede ser utilizado. El proyecto fue informado del problema tempranamente a través de un informe de problema pero aún no ha respondido."
}
],
"lastModified": "2026-06-17T10:44:03.563",
"sourceIdentifier": "cna@vuldb.com"
}