CVE-2026-112008 (CVSS 6.1)

Description

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.

Is your site exposed to CVE-2026-112008?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

EPSS — Exploit Prediction

0.0014

Probability of exploitation

0.04%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-131 CWE-131

References

Other References

https://hackmd.io/@haindpwn/libmng-ordr-chunk-store-oob-write https://sourceforge.net/projects/libmng/ https://sourceforge.net/projects/libmng/files/libmng-devel/2.0.3/ https://www.vulncheck.com/advisories/libmng-through-2.0.3-heap-buffer-overflow-via-ordr-chunk-reader-mng-read-ordr

Frequently Asked Questions

What is CVE-2026-112008? +

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application. It has a CVSS v3.1 base score of 6.1 (MEDIUM).

How severe is CVE-2026-112008? +

CVE-2026-112008 has a CVSS v3.1 score of 6.1 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0014, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-112008? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-57192

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified …

CVE-2026-27820

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain …

CVE-2026-95509

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

CVE-2026-107590

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in …

CVE-2026-78221

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to …

CVE-2026-41197

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, …

CVE-2026-112008