CVE-2026-112008Medium· 6.1▾ SunlitA flaw was found in libmng. A heap-based buffer overflow vulnerability exists in the mng_read_ordr() function due to improper buffer allocation sizing when parsing chunk records in Multiple-image Network Graphics (MNG) files. An attacker c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in libmng. A heap-based buffer overflow vulnerability exists in the mng_read_ordr() function due to improper buffer allocation sizing when parsing chunk records in Multiple-image Network Graphics (MNG) files. An attacker could exploit this vulnerability by enticing a user or system to process a specially crafted MNG image. Successful exploitation allows an attacker to corrupt memory, causing an application crash and resulting in a Denial of Service (DoS).
libmng: libmng: Denial of Service via heap-based buffer overflow in mng_read_ordr() — rated Moderate by Red Hat. Released 2026-10-18.
Affected:
No fix planned:
Out of support scope
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89085Medium· 6.6parted: parted: Heap-based buffer overflow via crafted FAT32 filesystem image (CVE-2026-89085)
CVE-2026-89088Medium· 5.5parted: parted: Denial of Service via heap buffer overflow during FAT16 resize (CVE-2026-89088)
CVE-2026-100229Medium· 6.5A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers)
CVE-2026-100231Medium· 6.1A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux)
CVE-2026-110247High· 8.8Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks
CVE-2026-109256Medium· 5.3FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure