CVE-2009-5063: Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-...

Security readout for executives and security teams

This is an old libpng denial-of-service issue. A specially crafted image can trigger a memory leak or crash in vulnerable libpng versions before 1.2.39beta5. The business risk is service instability where applications process untrusted images, especially upload, conversion, or thumbnailing workflows. Exposure is most likely in legacy applications, appliances, or statically linked software using libpng before 1.2.39beta5 to process untrusted image files. Modern maintained OS packages are less likely affected, but embedded and bundled copies need checking. Treat as a targeted availability risk for legacy image-processing services. It is not KEV-listed and has no provided CVSS score, so prioritize it behind actively exploited issues unless internet-facing upload or conversion systems still use old libpng. Mitigation focus: Inventory libpng versions in OS packages, containers, and statically bundled application dependencies.; Upgrade vulnerable libpng copies to vendor-supported fixed versions newer than the affected range.; Review Gentoo or relevant vendor advisories for package-specific remediation guidance..

Prepared

Jun 27, 2026, 18:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.