CVE-2017-18215: Opensuse Leap

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

xvpng.c in xv 3.10a has memory corruption (out-of-bounds write) when decoding PNG comment fields, leading to crashes or potentially code execution, because it uses an incorrect length value.

Affected products

• Opensuse Leap: version 42.3 only
• Xv Project Xv: version 3.10a only

Published 2018-03-05. Last modified 2026-06-17.