Some of the Bugs That Hid Inside Everyday Software for Decades
From a print-spooler flaw that Stuxnet quietly exploited to a 30-year-old graphics library hole, a handful of the most stubborn software vulnerabilities ever found show how long danger can lurk unnoticed.
Key points
- A flaw in libpng, a graphics library used by Linux, desktop apps, and Java software, sat undetected for 30 years before being fixed in February 2026.
- A Windows print-spooler bug introduced around 1996 let ordinary users quietly drop malicious files anywhere on a computer; the notorious Stuxnet worm exploited the same design weakness.
- AI-powered code-scanning tools helped uncover two critical flaws in PostgreSQL's encryption extension and a heap overflow in the Nginx web server, both dormant for roughly 20 years.
- A 2019 PuTTY bug, present since 1999, earned its finder a $3,645 bug-bounty reward after sitting in open-source code for nearly 21 years.
- The Windows graphics component Win32K has been responsible for more than half of all kernel-level security flaws found in Windows since the mid-1990s.
Software is built on top of older software, which is built on top of older software still. Most of the time that's fine. Occasionally it means a flaw introduced before some of today's developers were born is still sitting quietly inside code that runs hospitals and banks.
A CSO Online investigation traced 17 such bugs. Below are some of the most striking: flaws that took a decade or more to find and fix, and what they actually mean for ordinary people.
| Bug | Year introduced | Year fixed | Years dormant |
|---|---|---|---|
| Libpng heap overflow (CVE-2026-25646) | 1995 | Feb 2026 | ~30 |
| PrintDemon (Windows spooler) | ~1996 | May 2020 | ~24 |
| Win32K API flaws | 1996 | 2019 | ~23 |
| PuTTY heap overflow | 1999 | Oct 2019 | ~21 |
| PostgreSQL pgcrypto flaws | 2005 | Feb 2026 | ~20 |
| Nginx URL rewrite overflow (CVE-2026-42945) | 2008 | May 2026 | ~18 |
What did these bugs actually let attackers do?
Most of them let an outsider run their own code on a victim's machine, which is about as bad as it gets.
The libpng flaw (CVE-2026-25646) is a heap buffer overflow: a specially crafted image file could push more data into a program's memory than it expected, potentially forcing it to run attacker-supplied instructions. Debian, Red Hat and Ubuntu all ship vulnerable versions. The bug earned a severity score of 8.3 out of 10, classed as "high" rather than "critical", partly because the affected function is rarely called.
PrintDemon is stranger. Windows lets non-administrative users add printers, and those printers can write output to a file instead of paper. The printing service runs with full system privileges. Chain those facts together and a careful attacker can drop any file, including an executable, anywhere on the machine, even into folders that should be off-limits. Stuxnet, the worm that sabotaged Iranian nuclear centrifuges in the late 2000s, used the same underlying weakness.
How are AI tools changing the hunt for old bugs?
Faster scanning, not smarter guessing. AI code-analysis tools can read enormous codebases and test possible attack paths at machine speed, without fatigue or loss of focus.
Two PostgreSQL flaws hidden since 2005 in the database's pgcrypto extension (the part that scrambles stored data) were found at a 2025 hacking competition organised by security firm Wiz, with one discovery credited to an AI tool called Xint Code. A separate AI platform built by startup DepthFirst surfaced the Nginx overflow (CVE-2026-42945) along with three other flaws; patches landed in Nginx versions 1.30.1 and 1.31.0. Our earlier piece on AI finding thousands of flaws faster than humans can patch them, published 10 August 2026, covers how wide that gap is getting.
None of this represents a new category of attack. It's old-fashioned "find a memory error, force it to misbehave" work, done faster.
Should ordinary users worry?
For most of the bugs listed, yes, if your software is out of date.
The libpng, Nginx and PostgreSQL patches are recent. If you run Linux or any server software, check that automatic updates are on and that your vendor has issued a patched build. For older fixes like PrintDemon and the Win32K vulnerabilities, any Windows machine that has received updates since 2019 and 2020 is already protected.
Keep software updated. If you manage servers, treat the Nginx and libpng advisories as priority reading.
Common questions
Does this mean attackers have been using these bugs for years?
Not necessarily. "Found" and "exploited" are different things. The Win32K flaws were caught during active attacks, but most others on this list appear to have been discovered by researchers before criminals got there.
If I use a website that runs Nginx or PostgreSQL, is my data at risk?
Only if the site's operators haven't yet applied the available patches. Responsible operators patch quickly; if you're concerned, check the site's security disclosure page or contact their support team.
