CVE-2016-5735: Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attac...

Security readout for executives and security teams

CVE-2016-5735 affects pngquant 2.7.0, an image compression tool. A specially crafted PNG can trigger an integer overflow leading to a buffer overflow. The public record says impact is unspecified, so business risk depends on where pngquant processes untrusted image files. Exposure is most likely where pngquant 2.7.0, or downstream packages based on vulnerable code, process user-supplied PNGs in web uploads, media pipelines, CI assets, or batch image services. The source bundle does not identify other affected versions or products. Prioritize if pngquant is exposed to user-supplied images or automated media processing. If use is internal-only and updated through distribution packages, urgency is lower, but the unspecified impact means teams should still confirm version and patch status. Mitigation focus: Upgrade pngquant using vendor or distribution security guidance.; Apply Debian LTS security updates where Debian packaged pngquant is deployed.; Avoid processing untrusted PNGs with pngquant 2.7.0 until updated..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.