CVE-2004-0421: Libpng

Medium severity, CVSS 5.0. EPSS: 4.1% chance of exploitation in the next 30 days.

The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.

Affected products

• Libpng Libpng: version 1.0.0 only; version 1.0.5 only; version 1.0.6 only; version 1.0.7 only; version 1.0.8 only; version 1.0.9 only; …
• Openpkg Openpkg: version 1.3 only; version 2.0 only
• Red Hat Enterprise Linux: version 2.1 only; version 3.0 only
• Red Hat Enterprise Linux Desktop: version 3.0 only
• Red Hat Libpng: version 1.2.2-16 only; version 1.2.2-20 only
• Trustix Secure Linux: version 2.0 only; version 2.1 only

Published 2004-08-18. Last modified 2026-06-16.