CVE-2026-25646 is a heap-based buffer overflow vulnerability in the libpng library's png_set_quantize() function. When invoked without a histogram and with a palette exceeding twice the maximum display colors, certain valid PNG images cause the function to enter an infinite loop that reads beyond the allocated heap buffer. This can lead to out-of-bounds memory reads, potentially leaking sensitive information or causing denial of service via crashes. The vulnerability affects libpng versions prior to 1.6.55 and has been addressed in version 1.6.55. Red Hat has released security advisories and patches for affected distributions, including RHEL 7 Extended Lifecycle Support.

The vulnerability allows an attacker to cause out-of-bounds heap reads, which can lead to information disclosure such as leaking cryptographic keys or memory addresses, aiding in bypassing protection mechanisms like ASLR. It can also cause denial of service by crashing the application through segmentation faults. The CVSS v3.1 base score is 8.3 (High severity), reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high impact on availability with low impact on confidentiality and integrity. No known exploits in the wild have been reported.

A fix is available in libpng version 1.6.55 and later. Users and administrators should upgrade to version 1.6.55 or later to remediate this vulnerability. Red Hat has released updated packages for affected products, including Red Hat Enterprise Linux 7 Extended Lifecycle Support. Where upgrading is not immediately possible, no effective mitigation meeting Red Hat's criteria is currently available. Users should monitor vendor advisories for updates and apply patches as soon as they are released.