In png_decode of png.c, the row stride is computed as width multiplied by channel count using 32-bit arithmetic before being validated against the maximum allowed image size. An attacker-controlled width value in the IHDR chunk can cause this multiplication to overflow, wrapping the computed stride to a small value that passes the size check, while the pixel buffer is subsequently allocated using the wrapped stride. A later conversion loop still iterates using the original, un-wrapped width when indexing into that undersized buffer, resulting in an out-of-bounds heap read. This is reachable by decoding any attacker-supplied PNG file (e.g. via an image viewer, wallpaper loader, or icon loader).
CWE-190, CWE-125
Artfical DT Developer Talha Berk Arslan