lvandeve CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM lvandeve CVE published 2026-10-18

CVE-2026-112020

CVE-2026-112020 is a heap out-of-bounds read vulnerability in LodePNG through 20261006. The vulnerability is located in the lodepng::getFilterTypesInterlaced() function in lodepng_util.cpp and lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.