The libpng library contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service due to integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure via a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow in the png_set_quantize function. These vulnerabilities could potentially allow attackers to cause denial of service or leak information when processing PNG images. Red Hat has issued an important security advisory (RHSA-2026:4732) with updates for affected packages in Red Hat Enterprise Linux 8.2 AUS to remediate these issues.

Successful exploitation of these vulnerabilities could lead to denial of service conditions and information disclosure when processing PNG images using the vulnerable libpng library. The heap buffer overflow could also potentially lead to memory corruption. These impacts affect systems using the affected libpng versions in Red Hat Enterprise Linux 8.2 AUS. No known exploits in the wild have been reported at this time.

Red Hat has released updated libpng packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.2 AUS should apply the security update as described in Red Hat advisory RHSA-2026:4732. For detailed instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.