CVE-2017-12652: libpng Improper Input Validation
Vulnerability summary
CVE-2017-12652 is a critical (CVSS 9.8) Improper Input Validation vulnerability in libpng. EPSS estimates a 4.11% chance of exploitation in the next 30 days, higher than 90.7% of scored vulnerabilities.
Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 4% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 10-07-2019PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
CVSS metrics
6 scores · 5 sources · 3 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.11%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.11% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse8 products
- libpng12&distro=SUSE Linux Enterprise Server 12 SP4< 1.2.50-20.3.2
- libpng12&distro=SUSE Linux Enterprise Server 12 SP5< 1.2.50-20.3.2
- libpng12&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.2.50-20.3.2
- libpng12&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.2.50-20.3.2
- libpng12&distro=SUSE Linux Enterprise Software Development Kit 12 SP4< 1.2.50-20.3.2
Redhat4 products
- libpng< 2:1.5.13-8.el7
- libpng-debuginfo< 2:1.5.13-8.el7
- libpng-devel< 2:1.5.13-8.el7
- libpng-static< 2:1.5.13-8.el7
Ubuntu2 products
- libpngAll versions (No fix recorded) | < 1.2.54-1ubuntu1.1+esm1
- libpng1.6< 1.6.20-2ubuntu0.1~esm1
Debian1 product
- libpng1.6< 1.6.32-1
Libpng1 product
- libpng< 1.6.32
Netapp1 product
6 vendors · 17 products
References
23 links- github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCERelease NotesThird Party AdvisoryREPORT
- support.f5.com/csp/article/K88124225Third Party Advisory
- security.netapp.com/advisory/ntap-20220506-0003/Third Party Advisory
- support.f5.com/csp/article/K88124225?utm_source=f5support&%3Butm_medium=RSSX Refsource CONFIRMX Transferred
