The libpng library in Red Hat Enterprise Linux 9.4 Extended Update Support contains three distinct vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could potentially be exploited to cause denial of service or leak information. Red Hat has released updated libpng packages to address these issues.

The vulnerabilities can lead to information disclosure and denial of service conditions in systems using the affected libpng versions. Specifically, integer truncation and heap buffer over-read issues may expose sensitive data or cause application crashes. The heap buffer overflow could allow memory corruption, potentially leading to denial of service or other unintended behavior. No known exploits in the wild have been reported at this time.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 9.4 Extended Update Support that fix these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:3574 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. Patch status is confirmed as available from the vendor advisory.