CVE-2019-6129

png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer.

Score

CVSS 3.1 6.5 Medium

Status

Modified - cve@mitre.org

Published

2019-01-11

Last modified

2026-05-28

Weaknesses

CWE-401

Affected products

• Libpng (Libpng)

References

• https://github.com/glennrp/libpng/issues/269
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html