CVE-2017-6191

HIGH

apng_disassembler < 2.8 - Remote Code Execution via Crafted Filename

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-6191. PoCs published by Alwin Peppels.

AI-analyzed exploit summary This exploit demonstrates a buffer overflow vulnerability in APNGDis 2.8, where a fixed-size buffer (256 bytes) is overflowed by an overly long command-line argument, leading to a segmentation fault. The PoC includes GDB and Valgrind output confirming the crash.

Description

Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename.

Exploits (1)

exploitdb WORKING POC
by Alwin Peppels · textdosmultiple
https://www.exploit-db.com/exploits/41670

This exploit demonstrates a buffer overflow vulnerability in APNGDis 2.8, where a fixed-size buffer (256 bytes) is overflowed by an overly long command-line argument, leading to a segmentation fault. The PoC includes GDB and Valgrind output confirming the crash.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: APNGDis 2.8
No auth needed
Prerequisites: APNGDis 2.8 installed on the target system
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97053
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41670/

Scores

CVSS v3 7.8
EPSS 0.0668
EPSS Percentile 93.0%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (1)
apng_disassembler_project/apng_disassembler < 2.8
Published Mar 23, 2017
Tracked Since Feb 18, 2026