The libpng library in Red Hat Enterprise Linux 8.4 contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service via integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure through a heap buffer over-read in png_image_finish_read; CVE-2026-25646 is a heap buffer overflow in png_set_quantize. These vulnerabilities can lead to denial of service and potential information leakage. Red Hat has released updated libpng packages (version 1.6.34-8.el8_4.2) that fix these issues. The advisory rates the security impact as Important and provides references for patch application.

Successful exploitation of these vulnerabilities could result in denial of service conditions and information disclosure on affected systems running vulnerable versions of libpng. The heap buffer overflow could potentially lead to memory corruption. These issues affect image processing functionality related to PNG files, which may be leveraged by attackers to disrupt services or access sensitive information.

Red Hat has released updated libpng packages (version 1.6.34-8.el8_4.2) for Red Hat Enterprise Linux 8.4 Extended Life Cycle and Advanced Update Support variants that address these vulnerabilities. Users should apply these official patches promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the update.