In libpng version 1.8.0, the push‑mode APNG parser contains three paths that discard inter‑frame chunks without clearing the chunk‑header flag and without consuming the chunk body and CRC. This flaw allows attacker‑controlled bytes in an ignored ancillary chunk to be interpreted as a fresh chunk header on the next call to png_process_data. The resulting header smuggling can alter how the parser processes image data, potentially leading to memory corruption, crashes or unintended control flow.

The flaw affects libpng and libpng‑apng libraries distributed by the pnggroup, specifically the 1.8.0 release. Applications that link against these versions and parse APNG files are at risk. The vulnerability is fixed in commits after faf06924688b62d7c1654b5ceddedbde66ffadb4.

The CVSS score is 5.4, indicating moderate severity and the CVSS vector points to a local impact when an attacker can supply a malicious PNG. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is a crafted APNG file delivered to an application that parses APNG, which is inferred from the description. Although the exploit may not immediately result in code execution, improper header handling can cause crashes or memory corruption, which in some contexts could be leveraged for further exploitation.