---
id: CVE-2026-112008
title: >-
  libmng: libmng: Denial of Service via heap-based buffer overflow in
  mng_read_ordr() (CVE-2026-112008)
summary: >-
  A flaw was found in libmng. A heap-based buffer overflow vulnerability exists
  in the mng_read_ordr() function due to improper buffer allocation sizing when
  parsing chunk records in Multiple-image Network Graphics (MNG) files. An
  attacker c…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: vendor
cwe:
  - CWE-787
  - CWE-131
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T11:56:40+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112008.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112008.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-112008'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554765'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-112008'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112008'
  - url: 'https://hackmd.io/@haindpwn/libmng-ordr-chunk-store-oob-write'
  - url: 'https://sourceforge.net/projects/libmng/'
  - url: 'https://sourceforge.net/projects/libmng/files/libmng-devel/2.0.3/'
  - url: >-
      https://www.vulncheck.com/advisories/libmng-through-2.0.3-heap-buffer-overflow-via-ordr-chunk-reader-mng-read-ordr
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-18T11:40:26.622Z'
---

## Overview

A flaw was found in libmng. A heap-based buffer overflow vulnerability exists in the mng_read_ordr() function due to improper buffer allocation sizing when parsing chunk records in Multiple-image Network Graphics (MNG) files. An attacker could exploit this vulnerability by enticing a user or system to process a specially crafted MNG image. Successful exploitation allows an attacker to corrupt memory, causing an application crash and resulting in a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112008.json)

**libmng: libmng: Denial of Service via heap-based buffer overflow in mng_read_ordr()** — rated Moderate by Red Hat. Released 2026-10-18.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

## Remediation

Out of support scope