CVE-2008-3964

CVE-2008-3964 is a medium-severity vulnerability in Libpng with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-193.

Key facts

• Severity: Medium (CVSS 2.0 base score 4.3)
• EPSS exploit prediction: 3% (87th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-193
• Affected product: Libpng
• Published: 2008-09-11
• Last modified: 2026-06-16

Description

Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.

Frequently asked questions

What is CVE-2008-3964?

Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.

How severe is CVE-2008-3964?

CVE-2008-3964 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2008-3964 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2008-3964?

CVE-2008-3964 primarily affects Libpng. In total, 34 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2008-3964?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2008-3964 published?

CVE-2008-3964 was published on 2008-09-11 and last updated on 2026-06-16.

References

• http://secunia.com/advisories/31781
• http://secunia.com/advisories/33137
• http://secunia.com/advisories/35302
• http://secunia.com/advisories/35386
• http://security.gentoo.org/glsa/glsa-200812-15.xml
• http://sourceforge.net/mailarchive/forum.php?thread_name=e56ccc8f0809180317u6a5306fg14683947affb3e1b%40mail.gmail.com&forum_name=png-mng-implement
• http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=624517
• http://sourceforge.net/project/shownotes.php?release_id=624518
• http://sourceforge.net/tracker/index.php?func=detail&aid=2095669&group_id=5624&atid=105624
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1
• http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm
• http://www.kb.cert.org/vuls/id/889484
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:051
• http://www.openwall.com/lists/oss-security/2008/09/09/3
• http://www.openwall.com/lists/oss-security/2008/09/09/8
• http://www.securityfocus.com/bid/31049
• http://www.vupen.com/english/advisories/2008/2512
• http://www.vupen.com/english/advisories/2009/1462
• http://www.vupen.com/english/advisories/2009/1560
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44928

Affected products (34)

• cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta10:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta11:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta12:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta13:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta14:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta15:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta16:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta17:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta18:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta19:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta2:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta20:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta21:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta22:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta23:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta24:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta25:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta26:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta27:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta28:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta29:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta3:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta30:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta31:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta32:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta33:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta4:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta5:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta6:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta7:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta8:*:*:*:*:*:*
• cpe:2.3:a:libpng:libpng:1.4.0:beta9:*:*:*:*:*:*

More vulnerabilities in Libpng

• CVE-2017-12652 — Critical (CVSS 9.8): libpng before 1.6.32 does not properly check the length of chunks against the user limit.
• CVE-2010-1205 — Critical (CVSS 9.8): Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications,…
• CVE-2018-14550 — High (CVSS 8.8): An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow…
• CVE-2015-8540 — High (CVSS 8.8): Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66,…
• CVE-2015-0973 — High (CVSS 8.8): Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows…
• CVE-2014-9495 — High (CVSS 8.8): Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when…

All CVEs affecting Libpng →

Other CWE-193 (Off-by-one Error) vulnerabilities

• CVE-2024-10442 — Critical (CVSS 10.0): Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066,…
• CVE-2026-53309 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions()…
• CVE-2024-38441 — Critical (CVSS 9.8): Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to…
• CVE-2023-46853 — Critical (CVSS 9.8): In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used…
• CVE-2023-38429 — Critical (CVSS 9.8): An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in…
• CVE-2022-34970 — Critical (CVSS 9.8): Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful…

Browse all CWE-193 (Off-by-one Error) vulnerabilities →