CVE-2026-112008

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng read ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng read or mng readdisplay, writing attacker-controlled data past the allocation and crashing the application.