CVE-2026-3713: 
OpenJDK JDK vulnerability analysis and mitigation

CVE-2026-3713 is a heap-based buffer overflow vulnerability in pnggroup libpng up to version 1.6.55, specifically in the do_pnm2png() function within contrib/pngminus/pnm2png.c. The flaw is triggered by manipulating the width and/or height arguments in a crafted PNM file header, causing an integer overflow in the row_bytes calculation that leads to an undersized heap allocation and subsequent out-of-bounds write. The vulnerability was reported via a GitHub issue on February 18, 2026, and publicly disclosed on March 8, 2026; the libpng project had not responded to the report at time of disclosure. It carries a CVSS v3.1 base score of 5.3 (Medium), with local attack vector and low privileges required (Feedly, GitHub Issue).

The root cause is an integer overflow (CWE-190) leading to a heap-based buffer overflow (CWE-122) in the do_pnm2png() function. The variable row_bytes is declared as png_uint_32, and its value is derived from attacker-controlled width and height fields read directly from the PNM file header via fscan_pnm_uint_32(). The existing guard check — if ((row_bytes == 0) || ((size_t) height > (size_t) (-1) / (size_t) row_bytes)) — can be bypassed when row_bytes wraps around to a small non-zero value due to integer overflow, causing both conditions to evaluate to false. The undersized buffer is then allocated via png_malloc(), and the subsequent write loop at lines 405–411 uses the original (large) width and channels values to write width * channels bytes per row, overflowing the heap buffer. A proof-of-concept PNM file and build instructions using AddressSanitizer have been publicly released (GitHub Issue, PoC Repo).

Successful exploitation can result in low-impact confidentiality, integrity, and availability compromise on the local system, as reflected in the CVSS scoring. An attacker with local access who can supply a malicious PNM file to the pnm2png utility may cause a heap-buffer-overflow write, potentially leading to application crashes (denial of service), memory corruption, or in more advanced scenarios, arbitrary code execution within the context of the process. The vulnerability is confined to the pnm2png conversion utility (a contributed tool, not the core libpng library), limiting its scope primarily to systems where this utility is compiled and used (Feedly, GitHub Issue).

A proof-of-concept exploit (crafted PNM file) has been publicly published by the reporter in a GitHub repository, and the CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT (Feedly, PoC Repo). The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. IBM has acknowledged the vulnerability as affecting IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (IBM Advisory).

1. Craft a malicious PNM file: Create a PNM file with a header specifying extreme width and/or height values (e.g., near the maximum of png_uint_32, ~4294967295) designed to trigger integer overflow in the row_bytes calculation within do_pnm2png().
2. Bypass the guard check: Choose values such that row_bytes wraps to a small non-zero value after overflow, causing the guard condition (row_bytes == 0) || ((size_t) height > (size_t) (-1) / (size_t) row_bytes) to evaluate to false, allowing execution to continue.
3. Trigger undersized allocation: The overflowed row_bytes value is passed to png_malloc(), resulting in a heap buffer far smaller than needed for the actual image data.
4. Trigger heap buffer overflow: The write loop at lines 405–411 of pnm2png.c uses the original large width and channels values, writing width * channels bytes per row into the undersized buffer, overflowing the heap.
5. Achieve impact: Depending on heap layout and system protections, this may result in a crash (DoS), memory corruption, or potentially arbitrary code execution in the context of the pnm2png process (GitHub Issue, PoC Repo).

• Process: Unexpected crashes or abnormal termination of the pnm2png process, particularly when processing externally supplied PNM files; ASAN/sanitizer output referencing heap-buffer-overflow in do_pnm2png.
• File System: Presence of suspicious or malformed PNM files (especially with anomalously large width/height values in the header) in directories processed by pnm2png.
• Logs: Application crash logs or core dumps associated with pnm2png; error messages referencing png_malloc or memory allocation failures in libpng-related logs.
• Network: No network-based IOCs are expected, as the attack vector is local (GitHub Issue).

No official patch from the libpng project had been released at the time of disclosure, as the project had not responded to the issue report. IBM has addressed the vulnerability for affected IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data products — users of these products should apply the IBM security bulletin update (IBM Advisory). As a workaround, organizations should avoid exposing the pnm2png utility to untrusted input, restrict local user access to the tool, and monitor the libpng GitHub repository for an upstream patch. Compiling libpng with address sanitization or other memory safety tools can help detect exploitation attempts in development/test environments.

IBM issued a security bulletin acknowledging CVE-2026-3713 as affecting IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data, and provided remediation guidance (IBM Advisory). The vulnerability was assigned and published by VulDB, and the libpng project had not publicly responded to the issue report as of disclosure. No significant broader community discussion, researcher commentary, or major media coverage specific to this CVE was identified beyond standard vulnerability aggregator listings.