A vulnerability in the libpng library, specifically within the simplified API, poses a risk of memory disclosure and potential application instability when processing maliciously crafted PNG files.

This is an out-of-bounds read vulnerability (CWE-125) occurring in the simplified API. It allows an attacker to read up to 1012 bytes beyond the png_sRGB_base array when handling valid PNG files that utilize palette transparency and gamma correction.

The vulnerability carries a CVSS score of 7.1, indicating a high severity risk to application integrity and availability. Successful exploitation could lead to sensitive information disclosure from process memory or cause an application crash, potentially disrupting critical business services that rely on image processing.

Immediate Action: Update the libpng library to version 1.6.52 or later to incorporate the necessary memory safety fixes.

Proactive Monitoring: Monitor application logs for segmentation faults or abnormal termination errors occurring during image processing tasks.

Compensating Controls: Implement strict input validation or use sandboxed environments for image processing to limit the impact of potential memory access violations.

Public Exploit Available: No (exploit_available: unknown).

Given the potential for unauthorized memory access, organizations using libpng should prioritize upgrading to version 1.6.52 immediately. This update is essential to ensure the robustness of the library against memory-related exploits triggered by standard image files.