CVE-2015-7981: The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x...

Security readout for executives and security teams

A malicious PNG image can make vulnerable libpng versions read outside expected memory while formatting PNG time metadata. That can disclose sensitive process memory from software that parses attacker-supplied images. The bundle does not provide CVSS scoring or evidence of active exploitation, so urgency depends on whether exposed systems process untrusted PNG files. Exposure is most likely in image-processing paths that accept PNG files from users, partners, email, web uploads, or automated content pipelines. Systems using OS-packaged libpng or applications bundling old libpng branches should be checked. Prioritize remediation for internet-facing or high-volume image-processing systems because the issue can leak memory. For internal systems with no untrusted PNG input, handle through normal patch management unless local risk factors increase exposure. Mitigation focus: Upgrade libpng 1.0.x to 1.0.64 or later.; Upgrade libpng 1.2.x to 1.2.54 or later.; Upgrade libpng 1.4.x to 1.4.17 or later..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.