{"id":"CVE-2026-112008","title":"libmng: libmng: Denial of Service via heap-based buffer overflow in mng_read_ordr() (CVE-2026-112008)","summary":"A flaw was found in libmng. A heap-based buffer overflow vulnerability exists in the mng_read_ordr() function due to improper buffer allocation sizing when parsing chunk records in Multiple-image Network Graphics (MNG) files. An attacker c…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvssSource":"vendor","cwe":["CWE-787","CWE-131"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T11:56:40+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112008.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112008.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-112008"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554765"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112008"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112008"},{"url":"https://hackmd.io/@haindpwn/libmng-ordr-chunk-store-oob-write"},{"url":"https://sourceforge.net/projects/libmng/"},{"url":"https://sourceforge.net/projects/libmng/files/libmng-devel/2.0.3/"},{"url":"https://www.vulncheck.com/advisories/libmng-through-2.0.3-heap-buffer-overflow-via-ordr-chunk-reader-mng-read-ordr"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-18T11:40:26.622Z","slug":"CVE-2026-112008","body":"## Overview\n\nA flaw was found in libmng. A heap-based buffer overflow vulnerability exists in the mng_read_ordr() function due to improper buffer allocation sizing when parsing chunk records in Multiple-image Network Graphics (MNG) files. An attacker could exploit this vulnerability by enticing a user or system to process a specially crafted MNG image. Successful exploitation allows an attacker to corrupt memory, causing an application crash and resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112008.json)\n\n**libmng: libmng: Denial of Service via heap-based buffer overflow in mng_read_ordr()** — rated Moderate by Red Hat. Released 2026-10-18.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}