What’s Vulnerable › Vulnerabilities

CVE-2016-3982

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-04-13 · updated 2026-06-17
• Weakness: CWE-119

Description

Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 15.10
• Debian Linux: 7.0, 8.0
• openSUSE Leap: 42.1
• Opensuse: 13.2
• Optipng Project Optipng: through 0.7.5

References

• http://bugs.fi/media/afl/optipng/2/
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00065.html
• http://www.debian.org/security/2016/dsa-3546
• http://www.ubuntu.com/usn/USN-2951-1
• https://security.gentoo.org/glsa/201608-01
• https://sourceforge.net/p/optipng/bugs/57/
• http://bugs.fi/media/afl/optipng/2/
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00065.html
• http://www.debian.org/security/2016/dsa-3546
• http://www.ubuntu.com/usn/USN-2951-1

Get alerted when CVE-2016-3982 or the next vulnerability affects your stack