The libpng library in Red Hat Enterprise Linux 9 contains three security vulnerabilities: CVE-2026-22801 (information disclosure and denial of service via integer truncation in the simplified write API), CVE-2026-22695 (denial of service and information disclosure via heap buffer over-read in png_image_finish_read), and CVE-2026-25646 (heap buffer overflow in png_set_quantize). These vulnerabilities can lead to denial of service conditions and potential information leakage. Red Hat has released updated libpng packages to address these issues as detailed in advisory RHSA-2026:3405. The affected products include multiple Red Hat Enterprise Linux 9 variants across several hardware architectures. The advisory provides instructions for applying the update to remediate the vulnerabilities.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service or gain access to sensitive information through memory disclosure. The heap buffer overflow could potentially lead to more severe impacts such as arbitrary code execution, though this is not explicitly stated in the advisory. The vulnerabilities affect core image processing functionality in libpng, which is widely used in applications handling PNG files on affected Red Hat Enterprise Linux 9 systems.

Red Hat has released updated libpng packages that fix these vulnerabilities. Users of affected Red Hat Enterprise Linux 9 products should apply the security update as described in advisory RHSA-2026:3405 and the related Red Hat article https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. There are no indications from the vendor advisory that additional mitigations or workarounds are required beyond installing the official patches.