CVE-2007-2756

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-05-18 · updated 2026-06-16

Description

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.

Affected products

Libgd: 2.0.34

References

http://bugs.libgd.org/?do=details&task_id=86
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
http://osvdb.org/35788
http://osvdb.org/36643
http://rhn.redhat.com/errata/RHSA-2007-0889.html
http://secunia.com/advisories/25353
http://secunia.com/advisories/25362
http://secunia.com/advisories/25378
http://secunia.com/advisories/25535
http://secunia.com/advisories/25575
http://secunia.com/advisories/25590

Get alerted when CVE-2007-2756 or the next vulnerability affects your stack