CVE-2009-0040

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-02-22 · updated 2026-06-16
Weakness: CWE-824

Description

The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.

Affected products

Apple Iphone Os: before 3.0 — fixed in 3.0
macOS: before 10.5.8 — fixed in 10.5.8
Debian Linux: 4.0, 5.0
Fedoraproject Fedora: 9, 10
pnggroup libpng: before 1.0.43; from 1.2.0 before 1.2.35 — fixed in 1.0.43, 1.2.35
Opensuse: 10.3, 11.0, 11.1
SUSE Linux Enterprise: 9.0, 10.0
SUSE Linux Enterprise Server 15 SP1: 10-sp2
SUSE Linux Enterprise Server: 10-sp2

How to fix

Upgrade to a fixed version: Apple Iphone Os 3.0; macOS 10.5.8; pnggroup libpng 1.0.43, 1.2.35. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2009-0040 or the next vulnerability affects your stack