Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-10087

22
FAUCET Score

CVE-2016-10087 describes a NULL pointer dereference vulnerability in multiple versions of the libpng library (0.71 to 1.6.27). This flaw occurs when specific text chunk manipulation operations are performed on a PNG structure, potentially leading to a denial of service. With a CVSS v3 score of 7.5 (High), this vulnerability is remotely exploitable with low attack complexity and no user interaction required, resulting in high availability impact. While there is no known exploit intelligence (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, indicating awareness.

Impacted Technologies

VendorProductVersion(s)CPE
0.8CPE matchmatch criteria
cpe:2.3:a:libpng:libpng:0.8:*:*:*:*:*:*:*
0.71CPE matchmatch criteria
cpe:2.3:a:libpng:libpng:0.71:*:*:*:*:*:*:*
0.81CPE matchmatch criteria
cpe:2.3:a:libpng:libpng:0.81:*:*:*:*:*:*:*
0.82CPE matchmatch criteria
cpe:2.3:a:libpng:libpng:0.82:*:*:*:*:*:*:*
0.85CPE matchmatch criteria
cpe:2.3:a:libpng:libpng:0.85:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.0

Exploit Intelligence

EPSS Score
5.52%
Probability of exploitation in next 30 days
EPSS Percentile
92.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0552 is in the 86th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

microsoftpatch availablevia msrc
Product: 16826-17084Fixed in: 1.3.8-1
microsoftpatch availablevia msrc
Product: 16826-16817Fixed in: 1.3.8-1
microsoftpatch availablevia msrc
Product: azl3 fltk 1.3.8-1 on Azure Linux 3.0Fixed in: 1.3.8-1
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: libpng
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: libpng
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: libpng
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: libpng12
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Virtualization 3Fixed in: mingw-virt-viewer

Vendor Advisories (2)

microsoft2017-Jan/CVE-2016-10087Important

The libpng 0.71 allows context-dependent attackers to cause a NULL pointer dereference vectors

Jan 10, 2017
redhatCVE-2016-10087Low

libpng: NULL pointer dereference in png_set_text_2()

Dec 29, 2016

References

lists.apache.org / thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
lists.apache.org / thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
security.gentoo.org / glsa/201701-74
usn.ubuntu.com / 3712-1
usn.ubuntu.com / 3712-2
openwall.com / lists/oss-security/2016/12/29/2
Mailing ListThird Party Advisory
openwall.com / lists/oss-security/2016/12/30/4
Mailing ListThird Party Advisory
securityfocus.com / bid/95157
Third Party AdvisoryVDB Entry