Optipng is a specialized PNG image-optimization utility with a narrow but established deployment footprint across development and build pipelines. Its observed vulnerability exposure centers on memory-buffer boundary issues inherent to image-parsing code. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Optipng over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-7801HIGH Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file. | Apr 20, 2016 | 8.8 | 29 | NO | NO |
CVE-2017-16938HIGH A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, relate | Nov 24, 2017 | 7.8 | 25 | NO | NO |
CVE-2016-3982HIGH Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and c | Apr 13, 2016 | 8.8 | 25 | NO | NO |
CVE-2012-4432HIGH Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette | Oct 1, 2012 | 7.5 | 25 | NO | NO |
CVE-2016-2191MEDIUM The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delt | Apr 13, 2016 | 6.5 | 24 | NO | NO |
CVE-2008-5101HIGH Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow." | Nov 17, 2008 | 9.3 | 24 | NO | NO |
CVE-2023-43907HIGH OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c. | Oct 1, 2023 | 7.8 | 22 | NO | NO |
CVE-2017-1000229HIGH Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service. | Nov 17, 2017 | 7.8 | 22 | NO | NO |
CVE-2016-3981HIGH Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write acc | Apr 13, 2016 | 7.8 | 21 | NO | NO |
CVE-2009-0749HIGH Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of | Mar 2, 2009 | 7.8 | 20 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Optipng.
Media articles that mention a CVE ID that affects a product developed by Optipng — matched by CVE ID, not by vendor name.