CVE-2007-5266

CVE-2007-5266 is a medium-severity vulnerability in Libpng with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-189.

Key facts

• Severity: Medium (CVSS 2.0 base score 4.3)
• EPSS exploit prediction: 3% (87th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-189
• Affected product: Libpng
• Published: 2007-10-08
• Last modified: 2026-06-16

Description

Off-by-one error in ICC profile chunk handling in the png_set_iCCP function in pngset.c in libpng before 1.0.29 beta1 and 1.2.x before 1.2.21 beta1 allows remote attackers to cause a denial of service (crash) via a crafted PNG image that prevents a name field from being NULL terminated.

Frequently asked questions

What is CVE-2007-5266?

Off-by-one error in ICC profile chunk handling in the png_set_iCCP function in pngset.c in libpng before 1.0.29 beta1 and 1.2.x before 1.2.21 beta1 allows remote attackers to cause a denial of service (crash) via a crafted PNG image that prevents a name field from being NULL terminated.

How severe is CVE-2007-5266?

CVE-2007-5266 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2007-5266 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-5266?

CVE-2007-5266 affects Libpng. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2007-5266?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-5266 published?

CVE-2007-5266 was published on 2007-10-08 and last updated on 2026-06-16.

References

• http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html
• http://bugs.gentoo.org/show_bug.cgi?id=195261
• http://docs.info.apple.com/article.html?artnum=307562
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
• http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
• http://secunia.com/advisories/27284
• http://secunia.com/advisories/27529
• http://secunia.com/advisories/27629
• http://secunia.com/advisories/27746
• http://secunia.com/advisories/29420
• http://secunia.com/advisories/30161
• http://secunia.com/advisories/30430
• http://secunia.com/advisories/35302
• http://secunia.com/advisories/35386
• http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.520323
• http://sourceforge.net/mailarchive/forum.php?thread_name=5122753600C3E94F87FBDFFCC090D1FF0400EA68%40MERCMBX07.na.sas.com&forum_name=png-mng-implement
• http://sourceforge.net/mailarchive/message.php?msg_name=e56ccc8f0709140846k24e9a040r81623783b6b1c00f%40mail.gmail.com
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1
• http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm
• http://www.coresecurity.com/?action=item&id=2148
• http://www.gentoo.org/security/en/glsa/glsa-200711-08.xml
• http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:217
• http://www.securityfocus.com/archive/1/483582/100/0/threaded
• http://www.securityfocus.com/archive/1/489135/100/0/threaded
• http://www.securityfocus.com/bid/25957
• http://www.us-cert.gov/cas/techalerts/TA08-150A.html
• http://www.vupen.com/english/advisories/2008/0924/references
• http://www.vupen.com/english/advisories/2008/1697

Affected products (1)

• cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*

More vulnerabilities in Libpng

• CVE-2017-12652 — Critical (CVSS 9.8): libpng before 1.6.32 does not properly check the length of chunks against the user limit.
• CVE-2010-1205 — Critical (CVSS 9.8): Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications,…
• CVE-2018-14550 — High (CVSS 8.8): An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow…
• CVE-2015-8540 — High (CVSS 8.8): Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66,…
• CVE-2015-0973 — High (CVSS 8.8): Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows…
• CVE-2014-9495 — High (CVSS 8.8): Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when…

All CVEs affecting Libpng →

Other CWE-189 (Numeric Errors) vulnerabilities

• CVE-2015-8396 — Critical (CVSS 10.0): Integer overflow in the ImageRegionReader::ReadIntoBuffer function in…
• CVE-2015-7205 — Critical (CVSS 10.0): Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x…
• CVE-2015-6575 — Critical (CVSS 10.0): SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which…
• CVE-2015-3864 — Critical (CVSS 10.0): Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in…
• CVE-2015-3836 — Critical (CVSS 10.0): The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1…
• CVE-2015-3834 — Critical (CVSS 10.0): Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android…

Browse all CWE-189 (Numeric Errors) vulnerabilities →