A heap buffer overflow vulnerability in LIBPNG versions 1.6.0 through 1.6.50 may allow an attacker to trigger memory corruption and potential system instability via a maliciously crafted image file.

This vulnerability is a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) occurring in the png_image_finish_read function, which can be triggered by an unauthenticated attacker providing a specially crafted 16-bit interlaced PNG file for processing.

The vulnerability carries a CVSS score of 7.1, reflecting a significant risk to data integrity and system availability. Successful exploitation could lead to application crashes or arbitrary memory writes, which may be leveraged to achieve code execution in the context of the affected application. Organizations relying on software that utilizes LIBPNG for image processing are at risk of service disruption or compromise if they handle untrusted image data.

Immediate Action: Update the LIBPNG library to version 1.6.51 or later across all affected systems and applications.

Proactive Monitoring: Monitor application logs for segmentation faults or abnormal memory usage patterns in software that processes user-supplied image files.

Compensating Controls: Implement strict input validation or sandboxing for any image processing pipeline to isolate the library from the host system environment.

Public Exploit Available: No (exploit_available: false)

Given the potential for memory corruption and the existence of a proof-of-concept, this vulnerability warrants immediate attention. Security teams should prioritize identifying all instances of the LIBPNG library within their software inventory and apply the 1.6.51 update as soon as possible to neutralize the risk of exploitation.