The libpng library in Red Hat Enterprise Linux 9.4 Extended Update Support contains multiple memory safety vulnerabilities: a buffer overflow (CVE-2025-64720), a heap buffer overflow (CVE-2025-65018), and an out-of-bounds read (CVE-2025-66293). These issues could potentially lead to memory corruption when processing PNG images. Red Hat has released updated libpng packages to address these flaws. The advisory covers various architectures including x86_64, s390x, ppc64le, and aarch64. The vulnerabilities are categorized under CWE-125 (out-of-bounds read) and CWE-787 (out-of-bounds write). The vendor rates the security impact as Important and provides detailed instructions for applying the update.

Successful exploitation of these vulnerabilities could result in memory corruption, which may lead to application crashes or potentially arbitrary code execution depending on the context in which libpng is used. However, no known exploits in the wild have been reported. The vulnerabilities affect multiple Red Hat Enterprise Linux 9.4 Extended Update Support variants and architectures, potentially impacting systems processing PNG images with the vulnerable libpng versions.

Red Hat has released updated libpng packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support versions should apply the security update as described in the Red Hat advisory RHSA-2026:0211 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will remediate the buffer overflow and out-of-bounds read issues. No additional mitigation steps are indicated by the vendor.