CVE-2009-2042: libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisib...

Security readout for executives and security teams

CVE-2009-2042 is an information disclosure issue in libpng before 1.2.37. A specially formed PNG image could cause uninitialized memory bits to appear in image rows, potentially exposing sensitive data from memory. The source bundle does not show active exploitation. Exposure is most likely in applications, operating systems, appliances, or bundled software using libpng before 1.2.37 and processing untrusted PNG images. Vendor advisories indicate downstream packages existed across multiple ecosystems, but exact affected product versions are not complete in the bundle. Treat this as a patch hygiene and exposure-reduction item unless vulnerable image processing is internet-facing or handles untrusted uploads at scale. No active exploitation is evidenced in the provided sources. Mitigation focus: Upgrade libpng to 1.2.37 or later where vendor-supported.; Apply relevant OS, appliance, or application vendor security updates.; Inventory statically bundled libpng copies, not only system packages..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.