What’s Vulnerable › Vulnerabilities

CVE-2016-3981

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-04-13 · updated 2026-06-17
• Weakness: CWE-119

Description

Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 15.10
• Debian Linux: 7.0, 8.0
• Optipng Project Optipng: through 0.7.5

References

• http://bugs.fi/media/afl/optipng/1/
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00065.html
• http://www.debian.org/security/2016/dsa-3546
• http://www.ubuntu.com/usn/USN-2951-1
• https://security.gentoo.org/glsa/201608-01
• https://sourceforge.net/p/optipng/bugs/56/
• http://bugs.fi/media/afl/optipng/1/
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00065.html
• http://www.debian.org/security/2016/dsa-3546
• http://www.ubuntu.com/usn/USN-2951-1

Get alerted when CVE-2016-3981 or the next vulnerability affects your stack