Medium severity6.5OSV Advisory· Published Jan 11, 2019· Updated May 28, 2026

CVE-2019-6129

Description

png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pnggroup/LibpngOSV2 versions
libpng-1.6.10-signed, libpng-1.6.11-signed, libpng-1.6.12-signed, …+ 1 more
- (no CPE)range: libpng-1.6.10-signed, libpng-1.6.11-signed, libpng-1.6.12-signed, …
- (no CPE)range: =1.6.36
osv-coords
pkg:rpm/opensuse/libpng16&distro=openSUSE%20Tumbleweed
Range: < 1.6.40-2.1

Patches

Vulnerability mechanics

References

github.com/glennrp/libpng/issues/269nvdExploitThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000