CVE-2011-3464: Libpng

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

Off-by-one error in the png_formatted_warning function in pngerror.c in libpng 1.5.4 through 1.5.7 might allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors, which trigger a stack-based buffer overflow.

Affected products

• Libpng Libpng: version 1.5.0 only; version 1.5.1 only; version 1.5.2 only; version 1.5.3 only; version 1.5.4 only; version 1.5.5 only; …

Published 2012-07-22. Last modified 2026-06-16.