Pwnalone

**Name of the Vulnerable Software and Affected Versions** libpng versions prior to 1.6.55 **Description** An out-of-bounds read heap buffer overflow exists in the `png set quantize()` API function. The issue occurs when the function is called without a histogram and the palette contains more than twice the maximum number of colors supported by the user's display. Under these conditions, certain palettes can trigger an infinite loop that reads beyond the end of an internal heap-allocated buffer. Specially crafted PNG files that are valid according to the PNG specification can trigger this flaw, potentially leading to denial-of-service crashes, information disclosure, or arbitrary code execution. **Recommendations** Update libpng to version 1.6.55. As a temporary workaround, restrict the use of the `png set quantize()` function until the update is applied.