Skip to main content

libpng CVE-2026-25646

HIGH
Heap-based Buffer Overflow (CWE-122)
2026-02-10 security-advisories@github.com
Buffer Overflow Denial Of Service Libpng Heap Overflow
8.3
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-delivered image but trigger needs no-histogram call and oversized palette (AC:H); no auth (PR:N); main impact is DoS infinite loop (A:H) with minor heap read disclosure (C:L) and no write (I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

11
Analysis Updated
Jun 30, 2026 - 05:50 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 05:48 vuln.today
v4 (cvss_changed)
Source Code Evidence Fetched
Jun 30, 2026 - 05:48 vuln.today
Analysis Updated
Jun 30, 2026 - 05:48 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 05:47 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 03:23 vuln.today
cvss_changed
CVSS changed
Jun 30, 2026 - 03:23 NVD
8.1 (HIGH) 8.3 (HIGH)
Analysis Generated
Mar 12, 2026 - 22:02 vuln.today
PoC Detected
Feb 13, 2026 - 20:43 vuln.today
Public exploit code
Patch released
Feb 13, 2026 - 20:43 nvd
Patch available
CVE Published
Feb 10, 2026 - 18:16 nvd
HIGH 8.1

DescriptionCVE.org

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

AnalysisAI

Denial of service (with limited memory disclosure) in libpng before 1.6.55 lets an attacker supply a specially crafted but spec-valid PNG that, when processed via the png_set_quantize() API, traps the library in an infinite loop reading past the end of an internal heap buffer. Affects any application that links libpng and calls png_set_quantize() without a histogram while the palette holds more than twice the colors the display supports. Publicly available exploit code exists; EPSS is low (0.06%, 19th percentile) and it is not on CISA KEV, so widespread exploitation is not currently indicated.

Technical ContextAI

libpng is the de-facto reference decoder/encoder for the PNG raster format and is statically or dynamically linked into a vast range of OS components, browsers, image viewers, language runtimes, and server-side image pipelines. The flaw lives in pngrtran.c inside png_set_quantize(), the color-quantization helper that maps a full palette down to a smaller display palette. The root cause is classified as CWE-122 (heap-based buffer overflow); in practice the manifested behavior is an out-of-bounds READ caused by an unbounded loop. The upstream commit (01d03b8) shows the fix replaces direct byte casts of palette indices (t->left = (png_byte)i / t->right = (png_byte)j) with indirection through png_ptr->palette_to_index[i]/[j], correcting how palette entries are referenced so the quantization loop terminates and stays within the allocated buffer when no histogram is provided and the palette greatly exceeds the display's supported color count.

RemediationAI

Vendor-released patch: libpng 1.6.55 - upgrade to 1.6.55 or later, which contains the fix from commit 01d03b8453eb30ade759cd45c707e5a1c7277d88 (https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88). On Red Hat-based systems, apply the corresponding errata (e.g., RHSA-2026:3551 / 3577 / 4306 and the others listed at https://access.redhat.com/errata/) and rebuild or update any statically-linked applications that vendor their own libpng copy. If immediate patching is not possible, the most targeted compensating control is to avoid the vulnerable code path: ensure applications that call png_set_quantize() always pass a valid histogram (the no-histogram branch is where the loop triggers), or disable on-the-fly palette quantization for untrusted images - the trade-off is reduced color-reduction quality/performance on constrained displays. Validating or rejecting palette PNGs whose color count vastly exceeds the target display palette is another option but risks rejecting legitimate images; review the upstream advisory (GHSA-g8hp-mq4h-rqm3) for authoritative guidance.

More in Libpng

View all
CVE-2015-0973 HIGH POC
8.8 Jan 18

Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows

CVE-2015-8540 HIGH
8.8 Apr 14

Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.
CVE-2013-6954 MEDIUM POC
6.5 Jan 12

The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL poi
CVE-2025-66293 HIGH POC
7.1 Dec 03

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

CVE-2025-65018 HIGH POC
7.1 Nov 25

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

CVE-2025-64720 HIGH POC
7.1 Nov 25

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

CVE-2019-6129 MEDIUM POC
6.5 Jan 11

png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. Rated medium severity (CVS
CVE-2018-14048 MEDIUM POC
6.5 Jul 13

An issue has been found in libpng 1.6.34. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable,

CVE-2026-22695 MEDIUM POC
6.1 Jan 12

Libpng versions 1.6.51-1.6.53 contain a heap buffer over-read in the simplified API function png_image_finish_read when

CVE-2025-28164 MEDIUM POC
5.5 Jan 27

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_creat
CVE-2025-28162 MEDIUM POC
5.5 Jan 27

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngim
CVE-2014-9495 HIGH
8.8 Jan 10

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container private-registry/harbor-portal:1.1.1-1.28 Container suse/manager/5.0/x86_64/server-attestation:latest Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.2.8.15.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-EC2 Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-BYOS-EC2 Image server-attestation-image Image server-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.57 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.96 Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.27 Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2026-25646 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy