The libpng library in Red Hat Enterprise Linux 9.4 Extended Update Support contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service through integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure via a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could be exploited to cause denial of service or leak information. Red Hat has issued an important security advisory (RHSA-2026:3574) with updates that fix these issues.

Successful exploitation of these vulnerabilities could lead to denial of service conditions and information disclosure on affected systems running vulnerable versions of libpng. The heap buffer overflow could potentially allow for memory corruption. The vulnerabilities affect the libpng library used in Red Hat Enterprise Linux 9.4 Extended Update Support, impacting multiple architectures including x86_64 and s390x.

Red Hat has released updated libpng packages that address these vulnerabilities. Users should apply the security update described in Red Hat Advisory RHSA-2026:3574 to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No indication of alternative mitigations or workarounds is provided; applying the official update is the recommended action.