CVE-2012-3425

What it actually does

Out-of-bounds read in png_push_read_zTXt triggered by oversized avail_in in PNG zTXt chunks, resulting in application crash.

Why it matters to the business

Applications that render or process PNG images can be forced offline or made unstable, disrupting services that rely on image handling across many legacy systems still using unpatched libpng.

How an attack unfolds

An attacker creates a specially crafted PNG image containing a zTXt chunk with an inflated avail_in value and delivers it to any application linked against a vulnerable libpng build; when the library parses the chunk it reads past allocated buffers and crashes.

How to fix it

Upgrade libpng to 1.0.58 or newer, 1.2.48 or newer, 1.4.10 or newer, or 1.5.10 or newer on every affected system; rebuild and redeploy all dependent applications after the library update.

How to confirm the fix worked

Confirm the installed libpng shared object or header files report a version at or above the fixed releases; recompile a test application against the new library and verify that the crafted PNG no longer triggers a crash.

Typical attack path

1. Identify a target application or service that accepts PNG images and uses an affected libpng version.
2. Craft a minimal PNG containing a zTXt chunk with a large avail_in field.
3. Deliver the image via network upload, web request, email attachment, or file share.
4. Trigger parsing of the image inside the vulnerable library code path.
5. Observe denial-of-service through process crash or repeated restarts.

How to detect it

Review web-server, application, and system logs for abrupt crashes or segmentation faults immediately after PNG file handling; correlate with file-upload or image-processing events and inspect retained malicious PNG samples for oversized zTXt chunks.

What your security team should do

• Inventory all systems and containers that ship or link libpng and prioritize upgrades on internet-facing services first.
• Add libpng version checks to build pipelines and package manifests to prevent reintroduction of vulnerable releases.
• Monitor crash logs and image-processing error rates for sudden spikes that could indicate attempted exploitation.