Back
CVE-2009-0040
The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows…
- 6.8MediumCVSS base score
- 4.8%Exploitation in 30 daysEPSS · top 7.9% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.
Timeline
ID reserved
By redhat
- 2 months later
· 2 months later
Published
- 15 years later
· 15 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
- EPSS (exploitation in 30 days)
- 4.8% · top 7.9% of all CVEs (11 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Affected products
n/a
- affected n/a
References
References81
- RHSA-2009:0315 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- SUSE-SA:2009:023 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- http://support.apple.com/kb/HT3757 (opens in a new tab)x_refsource_CONFIRMx_transferred
- SUSE-SA:2009:012 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- GLSA-200903-28 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- RHSA-2009:0333 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- http://support.apple.com/kb/HT3639 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 35386 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- GLSA-201209-25 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- DSA-1830 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- ADV-2009-0632 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- ADV-2009-1621 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- RHSA-2009:0340 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- 1020521 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
- http://support.apple.com/kb/HT3549 (opens in a new tab)x_refsource_CONFIRMx_transferred
- ADV-2009-1560 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- oval:org.mitre.oval:def:10316 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
- ADV-2009-0469 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 34388 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2009-1462 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- SSA:2009-083-02 (opens in a new tab)vendor-advisoryx_refsource_SLACKWAREx_transferred
- APPLE-SA-2009-06-08-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
- 36096 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- [png-mng-implement] 20090219 libpng-1.2.35 and libpng-1.0.43 fix security vulnerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- http://www.vmware.com/security/advisories/VMSA-2009-0007.html (opens in a new tab)x_refsource_CONFIRMx_transferred
- RHSA-2009:0325 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- 259989 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
- 35302 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 33976 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 35074 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- libpng-pointer-arrays-code-execution(48819) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
- ADV-2009-1522 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 34140 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2009-1451 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- APPLE-SA-2009-06-17-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
- FEDORA-2009-2045 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- APPLE-SA-2009-05-12 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
- SUSE-SR:2009:005 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- MDVSA-2009:083 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
- 34464 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 34272 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 34210 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- APPLE-SA-2009-08-05-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
- oval:org.mitre.oval:def:6458 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
- 34265 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- http://wiki.rpath.com/Advisories:rPSA-2009-0046 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 34145 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 20090529 VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 35379 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2009-0473 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 34143 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- FEDORA-2009-2882 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- DSA-1750 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- FEDORA-2009-2884 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- SSA:2009-083-03 (opens in a new tab)vendor-advisoryx_refsource_SLACKWAREx_transferred
- 33970 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 34137 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- TA09-133A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
- [security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- http://sourceforge.net/project/shownotes.php?group_id=1689&release_id=662441 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 34462 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm (opens in a new tab)x_refsource_CONFIRMx_transferred
- ADV-2009-1297 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- FEDORA-2009-1976 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- http://downloads.sourceforge.net/libpng/libpng-1.2.34-ADVISORY.txt (opens in a new tab)x_refsource_CONFIRMx_transferred
- VU#649212 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
- 34324 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 20090312 rPSA-2009-0046-1 libpng (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 34152 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- MDVSA-2009:075 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
- 33990 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- http://support.apple.com/kb/HT3613 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 35258 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 33827 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm (opens in a new tab)x_refsource_CONFIRMx_transferred
- ADV-2009-2172 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- TA09-218A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
- MDVSA-2009:051 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
- 34320 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2009-0049 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2009-0040)Record last updated .