CVE-2026-112008 Details
Description
libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.
A heap-based buffer overflow vulnerability has been identified in libmng versions through 2.0.3. The issue arises in the ORDR chunk processing function, mng_read_ordr(), where the buffer for ORDR entries is allocated based on 5-byte on-wire records. This allocation method fails to account for the 8-byte in-memory size of the entries, leading to a heap overflow. Attackers can exploit this vulnerability by crafting a MNG file that includes the necessary chunks to trigger the overflow, causing application crashes and potential memory corruption.
Users can upgrade to libmng version 2.0.4 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the libmng SourceForge project page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/libmng-ordr-chunk-store-oob-write | [email protected] | ExploitTechnical Analysis |
| https://sourceforge.net/projects/libmng/ | [email protected] | ProductVendor |
| https://sourceforge.net/projects/libmng/files/libmng-devel/2.0.3/ | [email protected] | ProductSource CodeVendor |
| https://www.vulncheck.com/advisories/libmng-through-2.0.3-heap-buffer-overflow-via-ordr-chunk-reader-mng-read-ordr | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libmng | <= 2.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |