Vulnerability · Published Oct 18, 2026 · Assigned by VulnCheck

CVE-2026-112008libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr

Medium 6.1

In plain English

A medium-severity security flaw in libmng from libmng. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libmng	no fix listed	DEBIAN-CVE-2026-112008
Debian:13	libmng	no fix listed	DEBIAN-CVE-2026-112008
Debian:14	libmng	no fix listed	DEBIAN-CVE-2026-112008
Ubuntu:22.04:LTS	libmng	no fix listed	UBUNTU-CVE-2026-112008
Ubuntu:24.04:LTS	libmng	no fix listed	UBUNTU-CVE-2026-112008
Ubuntu:26.04:LTS	libmng	no fix listed	UBUNTU-CVE-2026-112008
Ubuntu:26.10	libmng	no fix listed	UBUNTU-CVE-2026-112008

Affected products (as reported)

Vendor	Product	Versions
libmng	libmng	0 – through 2.0.3

Weakness: CWE-131 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References

https://hackmd.io/@haindpwn/libmng-ordr-chunk-store-oob-write technical-description, exploit
https://sourceforge.net/projects/libmng/files/libmng-devel/2.0.3/ product
https://sourceforge.net/projects/libmng/ product
VulnCheck Advisory: libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr third-party-advisory