A flaw in libpng’s pnm2png function, specifically the handling of the width/height arguments in contrib/pngminus/pnm2png.c, allows an attacker to trigger a heap-based buffer overflow. The overflow can be exploited locally to overwrite memory in a way that could enable arbitrary code execution on the affected system. The weakness is identified with CWE-119 (Improper Restriction of Operations within the Bounds of a Buffer), CWE-122 (Heap-based Buffer Overflow) and CWE-131 (Incorrect Calculation of Buffer Size).

The vulnerability affects the pnggroup libpng library up to version 1.6.55. Any deployment that utilizes the pnm2png component, which can be run locally, is subject to this flaw. Versions newer than 1.6.55 are presumed not to contain the issue. No other vendors or products were explicitly listed.

The CVSS v3.1 score is 4.8, indicating a medium impact if exploited. The EPSS score is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploits have been published and are available, but they require local execution privileges. Attackers would need to control a local user context to trigger the overflow; elevated privileges would exacerbate the risk by enabling system-wide compromise.