The libpng library, which provides functions for creating and manipulating PNG image files, contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service due to integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure through a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities can lead to denial of service or information disclosure. Red Hat has issued an important security advisory (RHSA-2026:3551) with updated libpng packages for Red Hat Enterprise Linux 10 and its variants to address these issues.

The vulnerabilities can cause denial of service and information disclosure when processing PNG images using the affected libpng functions. The heap buffer overflow could potentially lead to memory corruption. These issues affect multiple architectures supported by Red Hat Enterprise Linux 10. No known exploits in the wild have been reported at this time.

Red Hat has released updated libpng packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related variants should apply the security update as described in Red Hat advisory RHSA-2026:3551. Detailed instructions and updated packages are available at https://access.redhat.com/articles/11258. Applying this update mitigates the vulnerabilities. There is no indication that additional mitigation steps are required beyond applying the official update.