Is CVE-2010-0205 being actively exploited?

CVE-2010-0205 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2010-0205?

CVE-2010-0205 has a CVSS 2.0 base score of 4.3 (MEDIUM).

CVE-2010-0205

MEDIUM · CVSS 4.3EPSS 4.5%EU EUVD

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

Key facts

CVSS score: 4.3 (v2.0)
Severity: MEDIUM
CVSS vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness (CWE): CWE-400
EPSS score: 4.5% (91th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2010-0236)
Published: March 3, 2010
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2010-0236 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

apple / mac os x
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
debian / debian linux
fedoraproject / fedora
fedoraproject / fedora
fedoraproject / fedora
libpng / libpng
opensuse / opensuse
opensuse / opensuse
opensuse / opensuse
suse / linux enterprise server
suse / linux enterprise server
suse / linux enterprise server
suse / linux enterprise server

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Apple Mac OS X 10.6 - Apple Inc. - Common Criteria BSI-DSZ-CC-0536-2010 - archived
SUSE Linux Enterprise Server Version 9 with Service Pack 2, ProPack 4 for Service Pack 2 and certification-sles-sgi-eal3 package - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0292-2005 - archived
SuSE Linux Enterprise Server Version 9 with certification-sles-ibm-eal4 package - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0256-2005 - archived
Apple Mac OS X v10.3.6 and Apple Mac OS X Server V10.3.6 - Apple Inc. - Common Criteria CCEVS-VR-0086-2005 - archived

References

http://libpng.sourceforge.net/ADVISORY-1.4.1.html(Third Party Advisory)
http://libpng.sourceforge.net/decompression_bombs.html(Third Party Advisory)
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html(Mailing List, Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037237.html(Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037355.html(Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037364.html(Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037607.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html(Mailing List)
http://lists.vmware.com/pipermail/security-announce/2010/000105.html(Third Party Advisory)
http://osvdb.org/62670(Broken Link)
http://secunia.com/advisories/38774(Third Party Advisory)
http://secunia.com/advisories/39251(Third Party Advisory)
http://secunia.com/advisories/41574(Third Party Advisory)
http://support.apple.com/kb/HT4435(Broken Link)
http://ubuntu.com/usn/usn-913-1(Third Party Advisory)
http://www.debian.org/security/2010/dsa-2032(Third Party Advisory)
http://www.kb.cert.org/vuls/id/576029(Third Party Advisory, US Government Resource)
http://www.mandriva.com/security/advisories?name=MDVSA-2010:063(Third Party Advisory)
http://www.mandriva.com/security/advisories?name=MDVSA-2010:064(Third Party Advisory)
http://www.securityfocus.com/bid/38478(Patch, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id?1023674(Third Party Advisory, VDB Entry)
http://www.vmware.com/security/advisories/VMSA-2010-0014.html(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0517(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0605(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0626(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0637(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0667(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0682(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0686(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0847(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/1107(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/2491(Third Party Advisory)
https://exchange.xforce.ibmcloud.com/vulnerabilities/56661(Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain