RSEC-2026-1
Risk of Buffer Overflow Vulnerability when installed from source on Windows R < 4.2
Published Mar 13, 2026 · updated Mar 26, 2026
Installing the png package from source on Windows could download and install an older version of libpng that has known vulnerabilities. On Windows R versions < 4.2, building the png package will download an archived libpng 1.5.4 from 2011. Note that on R versions 4.2 or newer, libpng is bundled in the relevant Rtools42+ and is not downloaded during png package installation. Check the Rtools release notes to see if the vulnerability applies. Where the vulnerable libpng is used, this represents a risk of buffer overflow when reading certain png files.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 13, 2026 · OSV.dev
Detected
Installing the png package from source on Windows could download and install an older version of libpng that has known vulnerabilities. On Windows R versions < 4.2, building the png package will download an archived libpng 1.5.4 from 2011. Note that on R versions 4.2 or newer, libpng is bundled in the relevant Rtools42+ and is not downloaded during png package installation. Check the Rtools releas
Mar 26, 2026 · OSV.dev
Fix available
png fixed in 0.1-9
Mar 26, 2026 · OSV.dev
Fix available
png fixed in 0.1-9
Mar 26, 2026 · OSV.dev
Updated
Installing the png package from source on Windows could download and install an older version of libpng that has known vulnerabilities. On Windows R versions < 4.2, building the png package will download an archived libpng 1.5.4 from 2011. Note that on R versions 4.2 or newer, libpng is bundled in the relevant Rtools42+ and is not downloaded during png package installation. Check the Rtools releas
Affected
- CRAN png0.1-3 → 0.1-9