The libpng library in Red Hat Enterprise Linux 9 contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service through integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure via a heap buffer over-read in the png_image_finish_read function; and CVE-2026-25646 is a heap buffer overflow in the png_set_quantize function. These vulnerabilities could allow attackers to cause denial of service or leak information when processing PNG images. Red Hat has released updated libpng packages to address these issues.

Successful exploitation of these vulnerabilities could lead to denial of service conditions and information disclosure on affected systems running vulnerable versions of libpng. The issues stem from memory handling errors such as integer truncation, heap buffer over-read, and heap buffer overflow in libpng functions. This could impact applications relying on libpng for PNG image processing.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 9 that fix these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:3405 and the referenced article https://access.redhat.com/articles/11258. The update is rated as Important by Red Hat Product Security. No additional mitigation steps are indicated beyond applying the official patch.