CVE-2026-112020

Name of the Vulnerable Software and Affected Versions LodePNG versions prior to 20261007

Description A heap out-of-bounds read occurs in the lodepng::getFilterTypesInterlaced() function within lodepng util.cpp due to missing bounds checks on decompressed IDAT data. An attacker can use a specially crafted interlaced PNG that declares a raster larger than its IDAT stream to cause an application crash or disclose adjacent heap memory.

Recommendations Update LodePNG to a version later than 20261006.