CVE-2026-40930

What it actually does

In libpng 1.8.0, the push-mode APNG parser can mishandle certain ignored inter-frame chunks. The parser clears its internal “chunk header seen” state before consuming the chunk body and CRC, so attacker-controlled bytes inside the ignored chunk may be treated as the next PNG chunk header when png_process_data is called again. This is an improper input validation/state-management flaw in incremental PNG/APNG parsing. Successful exploitation can corrupt parser state and may cause incorrect image parsing, processing errors, application crashes, or limited downstream integrity impact in applications that trust libpng output.

Why it matters to the business

Applications, web services, desktop software, or embedded products that process untrusted PNG/APNG files with libpng 1.8.0 may be disrupted by crafted images or may process image data incorrectly. The main operational risk is availability impact to image-processing workflows such as uploads, thumbnail generation, previews, media pipelines, messaging clients, or document rendering. Current public risk signals are relatively low: EPSS is 0.00202 and stable over 30 days, the issue is not listed in CISA KEV, is not known to be used in ransomware, and no public exploit maturity is indicated. However, libpng is commonly embedded and redistributed, so exposure can exist indirectly through dependent applications even when libpng is not installed as a standalone package.

How an attack unfolds

An attacker creates a malformed APNG file that reaches one of the affected inter-frame ancillary chunk discard paths in libpng’s push-mode parser. The crafted file places attacker-controlled bytes inside a chunk body that should be skipped. Because the vulnerable parser clears the chunk-header flag without consuming the rest of the chunk body and CRC, a later call to png_process_data can reinterpret bytes from the discarded chunk body as if they were a new PNG chunk header. The attacker then delivers the image to a target application through an upload, message, website, email attachment, API request, or other workflow that causes the application to parse the file with libpng 1.8.0 in push mode. If the application processes the image, parsing state may become inconsistent, potentially causing an error, crash, or incorrect handling of the image data.

How to fix it

Update libpng from version 1.8.0 to a version that includes commit faf06924688b62d7c1654b5ceddedbde66ffadb4 or a vendor-released build containing that fix. Because fixed package versions were not provided in the input, use vendor advisories, distribution security updates, or upstream release notes to identify the exact corrected package for each platform. Rebuild and redeploy applications that statically link libpng, and restart services that dynamically link to an updated shared library. Where immediate upgrade is not possible, reduce exposure by disabling APNG support if the application does not require it, avoiding push-mode parsing for untrusted files where feasible, rejecting or quarantining untrusted animated PNGs, enforcing strict file-size and processing-time limits, and running image parsing in a sandboxed, least-privileged worker process.

How to confirm the fix worked

Confirm that no production build is using libpng 1.8.0 without the upstream fix. Validate through package inventory, SBOMs, container image scans, dependency manifests, and binary inspection for statically bundled copies. For dynamically linked applications, verify the loaded libpng shared library version at runtime and confirm the service was restarted after patching. For source builds, confirm the codebase includes commit faf06924688b62d7c1654b5ceddedbde66ffadb4 or an equivalent vendor backport. Functional validation should include processing malformed APNG regression samples in a controlled test environment and confirming the parser rejects or safely handles them without crashes, hangs, or inconsistent output.

Typical attack path

1. Identify an application or service that accepts, previews, transforms, or renders PNG/APNG files using libpng 1.8.0.
2. Create a malformed APNG containing an ignored inter-frame ancillary chunk whose body bytes are chosen to be misread as a later chunk header.
3. Deliver the file through an upload form, media-processing API, message, email attachment, content feed, or hosted image reference.
4. Trigger parsing by the vulnerable application, typically during preview generation, validation, thumbnailing, conversion, or rendering.
5. Cause parser state confusion when png_process_data is called again after the affected discard path.
6. Achieve the practical impact available in the target context, most likely parser failure, service disruption, failed image processing, or limited integrity impact to generated output.

How to detect it

There are no unique public indicators that reliably prove exploitation from the CVE details alone. To assess possible prior exploitation, review logs and telemetry from systems that process PNG/APNG files, especially upload services, thumbnailers, preview generators, image converters, messaging platforms, and document-rendering components. Look for abnormal spikes in PNG/APNG parsing failures, worker crashes, segmentation faults, core dumps, container restarts, timeouts, or repeated failed uploads involving image/png content shortly before service instability. Preserve and examine suspicious PNG files associated with crashes; APNG files commonly contain acTL, fcTL, or fdAT chunks, but those chunks are legitimate and should be treated only as triage signals, not proof of compromise. EDR and crash telemetry should be searched for stack traces or faulting modules involving libpng PNG processing, especially png_process_data. Network, proxy, WAF, and application access logs can help correlate suspicious image uploads with subsequent parser crashes or media-processing failures.

What your security team should do

• Inventory applications, containers, appliances, and third-party products that process PNG/APNG files and determine whether they include libpng 1.8.0.
• Prioritize remediation for internet-facing upload services, media pipelines, messaging systems, document-rendering services, and any automated workflow that processes untrusted images.
• Apply vendor updates or rebuild with a libpng version containing commit faf06924688b62d7c1654b5ceddedbde66ffadb4.
• Check for statically linked or vendored libpng copies, not only operating-system packages.
• Temporarily restrict APNG handling or route image parsing through isolated worker sandboxes where patching will take longer.
• Add monitoring for crashes, repeated parser failures, and suspicious APNG uploads to image-processing endpoints.
• Because EPSS is low, stable, and the issue is not in KEV, treat this as a normal-priority patch unless the organization exposes high-volume untrusted image processing to the internet.