CVE-2015-8540: Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before...

Security readout for executives and security teams

CVE-2015-8540 is a libpng flaw triggered by a malformed PNG keyword containing a space. A remote attacker could supply a crafted image and cause an out-of-bounds read. The public record does not define the business impact, severity score, or active exploitation. Exposure is most likely where applications, image processing services, desktop software, or OS packages use vulnerable libpng versions and process untrusted PNG files. Treat as a dependency hygiene issue with higher priority for internet-facing image processing. No active exploitation is cited, but vulnerable image parsers can sit in many products and containers. Mitigation focus: Inventory libpng versions in applications, containers, and operating system packages.; Update to vendor-fixed libpng packages or fixed upstream branch releases.; Prioritize systems that process user-supplied or internet-sourced PNG files..

Prepared

Jun 13, 2026, 14:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.