Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-44081: Lodepng Can Crash When Processing Malformed PNG Images

CVE-2022-44081 · published 4 years ago

Summary

Lodepng, a PNG image processing library, has a bug that can cause it to crash when it encounters a corrupted or malformed PNG file. This issue affects the stability of applications that use Lodepng to process images. To fix this, update to a version of Lodepng that has this issue resolved.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:24.04:LTS	canonical	lodepng	All versions
Ubuntu:25.10	canonical	lodepng	All versions
Ubuntu:26.04	canonical	lodepng	All versions
–	lodev	lodepng	2022-07-17 `cpe:2.3:a:lodev:lodepng:2022-07-17:::::::*`

Original advisory text

Lodepng v20220717 was discovered to contain a segmentation fault via the function pngdetail.

References

https://ubuntu.com/security/CVE-2022-44081 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-44081 Third Party Advisory
https://github.com/lvandeve/lodepng/issues/177 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published31 Oct 2022

Updated3 Nov 2026

First seen27 Apr 2026

Sources

UBUNTU-CVE-2022-44081 · OSV

CVE-2022-44081 · NVD

Track software like this

Free during beta