NULL pointer dereference in libpng - CVE-2022-3857
Published: April 26, 2023 / Updated: November 26, 2025
Vulnerability identifier: #VU75517
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-3857
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the png_setup_paeth_row() function in pngwutil.c. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Affected software
libpng
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
How to mitigate CVE-2022-3857
Install update from vendor's website.
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1