Optipng Project maintains a PNG image optimization utility that, despite modest disclosure volume, occupies a notable position in image-processing pipelines across web servers, build systems, and content-delivery workflows. The recurring vulnerabilities cluster around memory-safety weaknesses including buffer overflows, out-of-bounds operations, integer overflows, and use-after-free conditions, reflecting the low-level image parsing and compression logic inherent to the tool. Defenders should monitor this vendor's updates where optipng is embedded in automated image processing or runs on untrusted input; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Optipng Project over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-7801HIGH Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file. | Apr 20, 2016 | 8.8 | 29 | NO | NO |
CVE-2017-16938HIGH A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, relate | Nov 24, 2017 | 7.8 | 25 | NO | NO |
CVE-2016-3982HIGH Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and c | Apr 13, 2016 | 8.8 | 25 | NO | NO |
CVE-2012-4432HIGH Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette | Oct 1, 2012 | 7.5 | 25 | NO | NO |
CVE-2016-2191MEDIUM The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delt | Apr 13, 2016 | 6.5 | 24 | NO | NO |
CVE-2008-5101HIGH Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow." | Nov 17, 2008 | 9.3 | 24 | NO | NO |
CVE-2023-43907HIGH OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c. | Oct 1, 2023 | 7.8 | 22 | NO | NO |
CVE-2017-1000229HIGH Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service. | Nov 17, 2017 | 7.8 | 22 | NO | NO |
CVE-2016-3981HIGH Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write acc | Apr 13, 2016 | 7.8 | 21 | NO | NO |
CVE-2009-0749HIGH Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of | Mar 2, 2009 | 7.8 | 20 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Optipng Project.
Media articles that mention a CVE ID that affects a product developed by Optipng Project — matched by CVE ID, not by vendor name.