CVE-2015-8126

CVE-2015-8126 is a high-severity vulnerability in Libpng with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 10% places it in the 95th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-120.

Key facts

• Severity: High (CVSS 2.0 base score 7.5)
• EPSS exploit prediction: 10% (95th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-120
• Affected product: Libpng
• Published: 2015-11-13
• Last modified: 2026-06-17

Description

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Frequently asked questions

What is CVE-2015-8126?

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

How severe is CVE-2015-8126?

CVE-2015-8126 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2015-8126 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 10% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-8126?

CVE-2015-8126 primarily affects Libpng. In total, 56 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-8126?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2015-8126 published?

CVE-2015-8126 was published on 2015-11-13 and last updated on 2026-06-17.

References

• http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172324.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172769.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172797.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172823.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177344.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177382.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.html
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.html
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.html

Affected products (56)

• cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
• cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
• cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
• cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*

More vulnerabilities in Libpng

• CVE-2017-12652 — Critical (CVSS 9.8): libpng before 1.6.32 does not properly check the length of chunks against the user limit.
• CVE-2010-1205 — Critical (CVSS 9.8): Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications,…
• CVE-2018-14550 — High (CVSS 8.8): An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow…
• CVE-2015-8540 — High (CVSS 8.8): Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66,…
• CVE-2015-0973 — High (CVSS 8.8): Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows…
• CVE-2014-9495 — High (CVSS 8.8): Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when…

All CVEs affecting Libpng →

Other CWE-120 (Classic Buffer Overflow) vulnerabilities

• CVE-2025-48611 — Critical (CVSS 10.0): In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead…
• CVE-2026-24823 — Critical (CVSS 10.0): Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT…
• CVE-2026-24810 — Critical (CVSS 10.0): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules).…
• CVE-2026-24800 — Critical (CVSS 10.0): Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow…
• CVE-2025-9962 — Critical (CVSS 10.0): A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior…
• CVE-2010-10016 — Critical (CVSS 10.0): BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u…

Browse all CWE-120 (Classic Buffer Overflow) vulnerabilities →