The libpng library in Red Hat Enterprise Linux 10 contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service through integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure via a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could allow attackers to cause denial of service or leak information when processing PNG images. Red Hat has released updates to fix these issues in libpng packages for Red Hat Enterprise Linux 10 and its variants.

Successful exploitation of these vulnerabilities could lead to denial of service conditions and information disclosure on affected systems running Red Hat Enterprise Linux 10. The heap buffer overflow could potentially allow for memory corruption, increasing the risk of system instability or further exploitation. No known exploits in the wild have been reported at this time.

Red Hat has provided official security updates for libpng in Red Hat Enterprise Linux 10 to address these vulnerabilities. Users should apply the updates as described in Red Hat advisory RHSA-2026:3551 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will mitigate the vulnerabilities. No additional action is required beyond applying the official patches.