The libpng library in Red Hat Enterprise Linux 8.2 AUS contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These issues can lead to denial of service and potential information leakage when processing PNG images. Red Hat has released updated libpng packages to fix these vulnerabilities as detailed in advisory RHSA-2026:4732.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service conditions or disclose sensitive information by crafting malicious PNG images that trigger integer truncation, heap buffer over-read, or heap buffer overflow in libpng functions. The impact is rated as high by Red Hat Product Security. There are no reports of active exploitation in the wild.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 8.2 AUS that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:4732 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified or required beyond applying the official patches.