libpng's push-mode APNG parser misreads a discarded chunk as a header
LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files.
- Advisory
- CVE-2026-40930
- Library
- libpng, libpng1.6 on Debian
- Published
- Severity
- 5.4 out of 10, as published
- Affected
- libpng 1.8.0
- Fixed in
- see the upstream record
- Reaches you
- by opening a file
What triggers it
Feeding a crafted APNG to libpng's progressive (push) reader, which discards an inter-frame ancillary chunk without consuming it.
What sillybos does
Needs decoding to detect
The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.
The flaw is in how the progressive reader resynchronises after a chunk, not in any field the chunk declares; sillybos reads every chunk's length and type and refuses a malformed chain, but a well-formed chain with this content passes. Only in the push-mode API, which Pillow does not use. Out of a header check's reach.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade libpng to a version that has the fix; the upstream record names it.
Specifically. Decode in a boxed process; prefer the pull-mode reader, which Pillow uses.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2026-40930
- The record entry, triaged 2026-11-03, last checked 2026-11-03