CVE-2015-7700

What it actually does

Double-free vulnerability in sPLT chunk handling within png.c allows memory corruption during PNG processing.

Why it matters to the business

Attackers could crash the image processing tool or execute arbitrary code when handling untrusted PNG files, leading to service disruption or full system compromise in environments that batch-process images.

How an attack unfolds

An attacker crafts a malicious PNG containing a specially formed sPLT chunk and supplies it to pngcrush; the tool's double-free logic in png.c is triggered during chunk processing, resulting in memory corruption that can be leveraged for code execution.

How to fix it

Upgrade pngcrush to version 1.7.87 or later to eliminate the double-free condition in sPLT handling.

How to confirm the fix worked

Confirm installed version is 1.7.87 or newer; test processing of known malicious PNG samples in an isolated environment to verify absence of crashes or corruption.

Typical attack path

1. Craft PNG file with malicious sPLT chunk
2. Deliver file to pngcrush via command line or automated pipeline
3. Trigger double-free during chunk parsing
4. Exploit resulting memory corruption for code execution or denial of service

How to detect it

Review process execution logs and crash dumps for pngcrush invocations involving untrusted PNG inputs; look for segmentation faults or heap-related errors during sPLT chunk processing.

What your security team should do

• Immediately upgrade all pngcrush installations to 1.7.87 or newer
• Scan build pipelines and image-processing workflows for outdated pngcrush binaries
• Restrict pngcrush execution to sanitized or trusted image sources until patched