libmng versions up to 2.0.3 contain a heap-based buffer overflow in the mng_read_ordr function. The vulnerability arises because ORDR entry buffers are sized based on 5-byte on-wire records while the in-memory entries require 8 bytes. An attacker can supply a crafted MNG file containing a multi-record ORDR chunk, prompting the library to write data beyond the allocated buffer. This corrupts heap memory and results in a crash. The flaw is identified as CWE-131 and CWE-787.

Linux, Windows, macOS, and any other platform where the libmng library version 2.0.3 or earlier is linked into an application. Applications that use the mng_read or mng_readdisplay APIs are susceptible, regardless of the application’s privilege level.

The CVSS base score is 6.9, indicating a moderate severity. EPSS data is unavailable, so the current exploitation probability is uncertain, but the vulnerability is listed as not part of CISA’s KEV catalog. The likely attack path requires an attacker to provide a malicious MNG file that an application will open, so the vector is typically the user or local execution of foreign data. Exploitation would result in memory corruption or denial of service. The flaw is identified as CWE-131 and CWE-787.