The vulnerability lies in LodePNG’s getFilterTypesInterlaced() routine in lodepng_util.cpp. Lacking bounds checks on the decompressed IDAT data, a malicious PNG can request a raster larger than the actual IDAT stream, causing the program to read beyond the intended heap region. This results in disclosure of adjacent heap memory contents or a potential crash, compromising confidentiality or availability of the application. The weakness is identified as CWE‑125, an out‑of‑bounds read.

The affected product is LVandEve’s LodePNG library, versions up to and including 20261006. Any application that uses this library to decode interlaced PNG images without further validation may be impacted. Users of newer releases that contain the patched implementation are not affected.

The CVSS score of 6.9 indicates medium severity. EPSS data is not available, and the issue is not listed in KEV, suggesting no widespread exploitation has been observed yet. However, since the flaw allows arbitrary heap memory disclosure, an attacker with the ability to supply crafted PNG files can potentially read sensitive data or crash the host application. The vulnerability is local to the execution context of the library and does not require elevated privileges, but it enables an attacker to influence the application’s behavior during decoding.