CVE-2011-3328: The png_handle_cHRM function in pngrutil.c in libpng 1.5.4, when color-correction support is enabled, allow...

Security readout for executives and security teams

CVE-2011-3328 is a denial-of-service flaw in libpng 1.5.4. A specially malformed PNG image can crash software that processes it when color-correction support is enabled. The main business risk is service disruption in systems that accept or render untrusted images. Exposure is likely where applications, libraries, or operating system components use libpng 1.5.4 with color-correction support enabled to parse untrusted PNG files. The bundle does not provide affected product CPEs, so exposure must be confirmed through dependency, package, and application inventory. Schedule remediation in normal vulnerability management, with faster handling for public upload, thumbnailing, or rendering services. The issue can interrupt service, but the provided evidence supports denial of service only, not data theft, privilege escalation, or active exploitation. Mitigation focus: Check vendor advisories for libpng updates or downstream package fixes.; Upgrade libpng or OS packages according to supported vendor guidance.; Restrict untrusted PNG processing in exposed upload or rendering paths where feasible..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.