What’s Vulnerable › Vulnerabilities

CVE-2018-14550

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-10 · updated 2026-06-17
• Weakness: CWE-787

Description

An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.

Affected products

• pnggroup libpng: 1.6.35
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Oncommand Api Services: all versions
• Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.6.0
• Oracle Corporation MySQL Workbench: through 8.0.23

References

• https://github.com/fouzhe/security/tree/master/libpng#stack-buffer-overflow-in-png2pnm-in-function-get_token
• https://github.com/glennrp/libpng/issues/246
• https://security.gentoo.org/glsa/201908-02
• https://security.netapp.com/advisory/ntap-20221028-0001/
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://github.com/fouzhe/security/tree/master/libpng#stack-buffer-overflow-in-png2pnm-in-function-get_token
• https://github.com/glennrp/libpng/issues/246
• https://security.gentoo.org/glsa/201908-02
• https://security.netapp.com/advisory/ntap-20221028-0001/
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Get alerted when CVE-2018-14550 or the next vulnerability affects your stack