Skip to main content

libpng CVE-2026-25646

HIGH
Heap-based Buffer Overflow (CWE-122)
2026-02-10 security-advisories@github.com
Buffer Overflow Denial Of Service Heap Overflow Libpng
8.3
CVSS 4.0 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Submit crafted palette PNG to decoder
  2. Delivery
    Application calls png_set_quantize() without histogram
  3. Exploit
    Oversized palette triggers unbounded loop
  4. Execution
    Out-of-bounds heap read in pngrtran.c
  5. Impact
    Process hangs/crashes, adjacent memory exposed

Vulnerability Assessment

Weakness
CWE
CWE-122
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application call libpng's png_set_quantize() with NO histogram argument AND process an attacker-supplied palette PNG whose number of colors is more than twice the maximum supported by the user's display - these exact conditions trigger the out-of-bounds read and infinite loop. The malicious image is valid per the PNG specification, so format-level validation will not reject it. Limiting factors: the application must actually use the quantization API on the histogram-less code path (many image pipelines do not call png_set_quantize() at all), the palette must exceed the 2x-display-colors threshold, and CVSS encodes AC:H plus AT:P meaning the attack is conditional rather than turnkey. No user authentication is required (PR:N) and the vector is network-reachable (AV:N) wherever an attacker can submit an image for decoding.
Impact

Signals are mixed and point to a real but conditional bug rather than a mass-exploitation event. The CVSS 4.0 base score is 8.3 (High) with AV:N/AC:H/AT:P/PR:N/UI:N and impact weighted toward availability (VA:H) with low confidentiality/integrity (VC:L/VI:L) - consistent with an unauthenticated, remotely-reachable DoS that also reads adjacent heap memory. Crucially AC:H plus AT:P encode that exploitation requires specific, non-trivial conditions (no histogram supplied and a palette more than twice the display maximum), which tempers the otherwise high score. EPSS is very low (0.06%) and the CVE is not in CISA KEV, while a public advisory/POC reference exists. These align rather than conflict: a usable trigger is known, but real-world automated exploitation is currently improbable and the primary outcome is a crash/hang, not code execution. Note the labeling tension to verify: tags and CWE-122 say 'heap overflow,' but the description explicitly describes an out-of-bounds READ and infinite loop - treat the integrity/write impact (VI:L) cautiously and confirm with the vendor advisory whether any write primitive exists.
Exploit ScenarioDerived

An attacker crafts a spec-compliant palette PNG containing far more colors than the victim's display supports and delivers it to a service or client that decodes images with libpng and invokes png_set_quantize() without a histogram (e.g., an image-thumbnailing backend or a viewer). When the image is processed, libpng enters an infinite loop reading past its heap buffer, hanging or crashing the process and potentially leaking adjacent heap bytes. Public POC/advisory material exists, and the network attack vector means delivery can be as simple as an uploaded or linked image, though the high attack complexity (specific palette/no-histogram conditions) limits reliable success.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Denial of service (with limited memory disclosure) in libpng before 1.6.55 lets an attacker supply a specially crafted but spec-valid PNG that, when processed via the png_set_quantize() API, traps the library in an infinite loop reading past the end of an internal heap buffer. Affects any application that links libpng and calls png_set_quantize() without a histogram while the palette holds more than twice the colors the display supports. Publicly available exploit code exists; EPSS is low (0.06%, 19th percentile) and it is not on CISA KEV, so widespread exploitation is not currently indicated.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 05:48 cvss changed CVSS 8.3

Denial of service in libpng before 1.6.55 allows remote attackers to trigger an infinite loop and out-of-bounds heap read via the png_set_quantize() API. When an application calls png_set_quantize() with no histogram and processes a palette image whose color count exceeds twice the display's maximum supported colors, certain spec-valid palettes drive the routine to read past an internal heap buffer indefinitely. Publicly available exploit code exists (GitHub advisory GHSA-g8hp-mq4h-rqm3), but the EPSS score is very low (0.06%, 19th percentile) and it is not listed in CISA KEV, indicating no confirmed widespread exploitation.

v3 Jun 30, 2026 - 05:48 cvss changed CVSS 8.3

Denial-of-service (and minor memory disclosure) in libpng before 1.6.55 occurs when an application calls png_set_quantize() without a supplied histogram while the palette holds more than twice the colors the user's display supports; specially crafted but spec-valid PNG palettes drive the function into an infinite loop that reads past the end of an internal heap-allocated buffer (CWE-122). The flaw affects any consumer of the libpng quantization path and is fixed in 1.6.55. Publicly available exploit code exists via the upstream GitHub security advisory, though EPSS exploitation probability is low (0.06%, 19th percentile) and the issue is not listed in CISA KEV.

v2 Jun 30, 2026 - 05:47 cvss changed CVSS 8.3

Out-of-bounds read (and resulting infinite loop / denial of service) in libpng's png_set_quantize() API affects all releases prior to 1.6.55 and is fixed in 1.6.55. When an application calls png_set_quantize() without supplying a histogram and the palette contains more than twice the colors supported by the user's display, specially crafted but specification-valid PNG palettes drive the function into an unterminated loop that reads past the end of an internal heap-allocated buffer. The flaw was reported via GitHub's security team; publicly available exploit code exists, but it is not listed in CISA KEV and EPSS is very low (0.06%), indicating no observed widespread exploitation.

v1 Mar 12, 2026 - 22:02 CVSS 8.1

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. [CVSS 8.1 HIGH]

RemediationAI

Vendor-released patch: libpng 1.6.55 - upgrade to 1.6.55 or later, which contains the fix from commit 01d03b8453eb30ade759cd45c707e5a1c7277d88 (https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88). On Red Hat-based systems, apply the corresponding errata (e.g., RHSA-2026:3551 / 3577 / 4306 and the others listed at https://access.redhat.com/errata/) and rebuild or update any statically-linked applications that vendor their own libpng copy. If immediate patching is not possible, the most targeted compensating control is to avoid the vulnerable code path: ensure applications that call png_set_quantize() always pass a valid histogram (the no-histogram branch is where the loop triggers), or disable on-the-fly palette quantization for untrusted images - the trade-off is reduced color-reduction quality/performance on constrained displays. Validating or rejecting palette PNGs whose color count vastly exceeds the target display palette is another option but risks rejecting legitimate images; review the upstream advisory (GHSA-g8hp-mq4h-rqm3) for authoritative guidance.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libpng is the de-facto reference decoder/encoder for the PNG raster format and is statically or dynamically linked into a vast range of OS components, browsers, image viewers, language runtimes, and server-side image pipelines. The flaw lives in pngrtran.c inside png_set_quantize(), the color-quantization helper that maps a full palette down to a smaller display palette. The root cause is classified as CWE-122 (heap-based buffer overflow); in practice the manifested behavior is an out-of-bounds READ caused by an unbounded loop. The upstream commit (01d03b8) shows the fix replaces direct byte casts of palette indices (t->left = (png_byte)i / t->right = (png_byte)j) with indirection through png_ptr->palette_to_index[i]/[j], correcting how palette entries are referenced so the quantization loop terminates and stays within the allocated buffer when no histogram is provided and the palette greatly exceeds the display's supported color count.

Know when Libpng gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.3 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
vuln.today AI 6.5 MEDIUM

Network-delivered image but trigger needs no-histogram call and oversized palette (AC:H); no auth (PR:N); main impact is DoS infinite loop (A:H) with minor heap read disclosure (C:L) and no write (I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
Low
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

8
Analysis Updated
Jun 30, 2026 - 05:50 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:48 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:48 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:47 vuln.today
v2 - CVSS changed
CVSS changed
Jun 30, 2026 - 03:23 NVD
8.1 (HIGH) 8.3 (HIGH)
PoC Detected
Feb 13, 2026 - 20:43 vuln.today
Public exploit code
Patch released
Feb 13, 2026 - 20:43 nvd
Patch available
CVE Published
Feb 10, 2026 - 18:16 nvd
HIGH 8.1

DescriptionCVE.org

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Executive ViewAI

Why It Matters

libpng, a widely-used image processing library (CVE-2026-25646, CVSS 8.3), contains a denial-of-service vulnerability affecting applications that process PNG images. Organizations may experience interruptions to image handling, graphics conversion, or document processing services if exploited. Publicly available exploit code exists, though active exploitation has not been observed.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Prevalence
Ubiquitous
reference PNG library embedded in OSes, browsers, and image pipelines
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

62
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*

More in Libpng

View all
CVE-2015-0973 HIGH POC
8.8 Jan 18

Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows

CVE-2015-8540 HIGH
8.8 Apr 14

Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.
CVE-2013-6954 MEDIUM POC
6.5 Jan 12

The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL poi
CVE-2025-64720 HIGH POC
7.1 Nov 25

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

CVE-2025-65018 HIGH POC
7.1 Nov 25

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

CVE-2025-66293 HIGH POC
7.1 Dec 03

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

CVE-2019-6129 MEDIUM POC
6.5 Jan 11

png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. Rated medium severity (CVS
CVE-2018-14048 MEDIUM POC
6.5 Jul 13

An issue has been found in libpng 1.6.34. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable,

CVE-2026-22695 MEDIUM POC
6.1 Jan 12

Libpng versions 1.6.51-1.6.53 contain a heap buffer over-read in the simplified API function png_image_finish_read when

CVE-2025-28164 MEDIUM POC
5.5 Jan 27

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_creat
CVE-2025-28162 MEDIUM POC
5.5 Jan 27

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngim
CVE-2014-9495 HIGH
8.8 Jan 10

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container private-registry/harbor-portal:1.1.1-1.28 Container suse/manager/5.0/x86_64/server-attestation:latest Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.2.8.15.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-EC2 Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-BYOS-EC2 Image server-attestation-image Image server-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.57 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.96 Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.27 Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

References

Advisories & patches
PATCH https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88 ADVISORY https://access.redhat.com/errata/RHSA-2026:3031 ADVISORY https://access.redhat.com/errata/RHSA-2026:3405 ADVISORY https://access.redhat.com/errata/RHSA-2026:3551 ADVISORY https://access.redhat.com/errata/RHSA-2026:3573 ADVISORY https://access.redhat.com/errata/RHSA-2026:3574 ADVISORY https://access.redhat.com/errata/RHSA-2026:3575 ADVISORY https://access.redhat.com/errata/RHSA-2026:3576 ADVISORY https://access.redhat.com/errata/RHSA-2026:3577 ADVISORY https://access.redhat.com/errata/RHSA-2026:3968 ADVISORY https://access.redhat.com/errata/RHSA-2026:3969 ADVISORY https://access.redhat.com/errata/RHSA-2026:4221 ADVISORY https://access.redhat.com/errata/RHSA-2026:4222 ADVISORY https://access.redhat.com/errata/RHSA-2026:4306 ADVISORY https://access.redhat.com/errata/RHSA-2026:4501 ADVISORY https://access.redhat.com/errata/RHSA-2026:4728 ADVISORY https://access.redhat.com/errata/RHSA-2026:4729 ADVISORY https://access.redhat.com/errata/RHSA-2026:4730 ADVISORY https://access.redhat.com/errata/RHSA-2026:4731 ADVISORY https://access.redhat.com/errata/RHSA-2026:4732 ADVISORY https://access.redhat.com/errata/RHSA-2026:4756 ADVISORY https://access.redhat.com/errata/RHSA-2026:5606 ADVISORY https://access.redhat.com/errata/RHSA-2026:6439 ADVISORY https://access.redhat.com/errata/RHSA-2026:6445 ADVISORY https://access.redhat.com/errata/RHSA-2026:6466 ADVISORY https://access.redhat.com/errata/RHSA-2026:6467 ADVISORY https://access.redhat.com/errata/RHSA-2026:6468 ADVISORY https://access.redhat.com/errata/RHSA-2026:6469 ADVISORY https://access.redhat.com/errata/RHSA-2026:6553 ADVISORY https://access.redhat.com/errata/RHSA-2026:7032 ADVISORY https://access.redhat.com/errata/RHSA-2026:7033 ADVISORY https://access.redhat.com/errata/RHSA-2026:7034 ADVISORY https://access.redhat.com/errata/RHSA-2026:7035 ADVISORY https://access.redhat.com/errata/RHSA-2026:7036 ADVISORY https://vuldb.com/?id.345136 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0583/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0596/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0597/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0598/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0599/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20523/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20530/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20750/ REF http://www.openwall.com/lists/oss-security/2026/02/09/7 REF https://access.redhat.com/errata/RHSA-2026:10097 REF https://access.redhat.com/errata/RHSA-2026:12274 REF https://access.redhat.com/errata/RHSA-2026:14773 REF https://access.redhat.com/errata/RHSA-2026:15087 REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:17596 REF https://access.redhat.com/errata/RHSA-2026:6732 REF https://access.redhat.com/errata/RHSA-2026:7239 REF https://access.redhat.com/errata/RHSA-2026:7243 REF https://access.redhat.com/errata/RHSA-2026:8746 REF https://access.redhat.com/errata/RHSA-2026:8747 REF https://access.redhat.com/errata/RHSA-2026:8748 REF https://access.redhat.com/errata/RHSA-2026:9254 REF https://access.redhat.com/errata/RHSA-2026:9255 REF https://access.redhat.com/errata/RHSA-2026:9683 REF https://access.redhat.com/errata/RHSA-2026:9686 REF https://access.redhat.com/errata/RHSA-2026:9687 REF https://access.redhat.com/errata/RHSA-2026:9689 REF https://access.redhat.com/security/cve/CVE-2026-25646 REF https://bugzilla.redhat.com/show_bug.cgi?id=2438542 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25646.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy