Some of the Bugs That Hid Inside Everyday Software for Decades
From a print-spooler flaw that Stuxnet quietly exploited to a 30-year-old graphics library hole, a handful of the most stubborn software vulnerabilities ever found show how long danger can lurk unnoticed.
Key points
- A flaw in libpng, a graphics library used by Linux, desktop apps, and Java software, sat undetected for 30 years before being fixed in February 2026.
- A Windows print-spooler bug introduced around 1996 let ordinary users quietly drop malicious files anywhere on a computer, and the notorious Stuxnet worm exploited the same design weakness.
- AI-powered code-scanning tools helped uncover two critical flaws in PostgreSQL's encryption extension and a heap overflow in the Nginx web server, both of which had been dormant for roughly 20 years.
- A 2019 PuTTY bug, present since 1999, earned its finder a $3,645 bug-bounty reward after sitting in open-source code for nearly 21 years.
- Security researchers say the Windows graphics component Win32K has been responsible for more than half of all kernel-level security flaws found in Windows since the mid-1990s.
Software is built on top of older software, which is built on top of older software still. Most of the time that is fine. Occasionally it means a flaw introduced before some of today's developers were born is still sitting quietly inside code that runs hospitals, banks, and online shops.
A CSO Online investigation traced 17 such bugs. Below are some of the most striking: flaws that took a decade or more to find and fix, plus what they actually mean for ordinary people.
| Bug | Year introduced | Year fixed | Years dormant |
|---|---|---|---|
| Libpng heap overflow (CVE-2026-25646) | 1995 | Feb 2026 | ~30 |
| PrintDemon (Windows spooler) | ~1996 | May 2020 | ~24 |
| Win32K API flaws | 1996 | 2019 | ~23 |
| PuTTY heap overflow | 1999 | Oct 2019 | ~21 |
| PostgreSQL pgcrypto flaws | 2005 | Feb 2026 | ~20 |
| Nginx URL rewrite overflow (CVE-2026-42945) | 2008 | May 2026 | ~18 |
What did these bugs actually let attackers do?
Most of them let an outsider run their own code on a victim's machine, which is about as bad as it gets.
The libpng flaw (CVE-2026-25646) is a "heap buffer overflow", meaning a specially crafted image file could push more data into a program's memory than the program expected, potentially forcing it to run attacker-supplied instructions. Debian, Red Hat, and Ubuntu all ship vulnerable versions of the library. The bug earned a severity score of 8.3 out of 10, classed as "high" but not "critical", partly because the affected function is rarely called.
PrintDemon is stranger. Windows lets ordinary (non-administrator) users add printers. It also lets those fake printers write output to a file instead of paper. Crucially, the printing service runs with full system privileges. Chain those three facts together and a careful attacker can drop any file, including a program, anywhere on the machine, even into folders that should be off-limits. Stuxnet, the worm that sabotaged Iranian nuclear centrifuges in the late 2000s, used the same underlying weakness.
How are AI tools changing the hunt for old bugs?
Faster scanning, not smarter guessing. AI code-analysis tools can read enormous codebases and test possible attack paths at machine speed, without getting tired or losing focus.
Two PostgreSQL flaws hidden since 2005 in the database's "pgcrypto" encryption extension (which is the part of the software that scrambles and unscrambles stored data) were found at a 2025 hacking competition organised by security firm Wiz, with one discovery credited to an AI tool called Xint Code. A separate AI platform built by startup DepthFirst surfaced the Nginx overflow (CVE-2026-42945) along with three other flaws. Patches landed in Nginx versions 1.30.1 and 1.31.0.
None of this represents a new category of attack. It is old-fashioned "find a memory error, force it to misbehave" work, just done faster.
Should ordinary users worry?
For most of the bugs listed, yes, if your software is out of date.
The libpng, Nginx, and PostgreSQL patches are recent. If you run Linux, a Java-based application, or any server software, make sure automatic updates are on and check that your vendor has issued a patched build. For the older fixes like PrintDemon and the Win32K vulnerabilities, any Windows machine that has received updates since 2019 and 2020 is already protected.
The practical advice is simple: keep software updated, and if you manage servers, treat the Nginx and libpng advisories as priority reading this week.
Common questions
Does this mean attackers have been using these bugs for years?
Not necessarily. "Found" and "exploited" are different things. The Win32K flaws were caught during active attacks, but most others on this list appear to have been discovered by researchers before criminals got there.
If I use a website that runs Nginx or PostgreSQL, is my data at risk?
Only if the site's operators have not yet applied the available patches. Responsible operators patch quickly; if you are concerned, check the site's security disclosure page or contact their support team.
