CVE-2004-0597

CVE-2004-0597 describes multiple buffer overflows in libpng 1.2.5 and earlier, affecting products like greg_roelofs and Microsoft MSN Messenger. These vulnerabilities allow remote attackers to execute arbitrary code through malformed PNG images due to insufficient validation and bounds checking in functions handling transparency, significant bits, and histogram data. With a CVSS score of 10.0, this critical vulnerability poses a high risk of complete compromise (confidentiality, integrity, availability) with low attack complexity and no authentication required. While not listed in CISA's KEV catalog, exploit code is publicly available on ExploitDB, though there is no indication of active exploitation or significant community discussion.