The libpng packages in Red Hat Enterprise Linux 8 contain multiple vulnerabilities: a buffer overflow (CVE-2025-64720), a heap buffer overflow (CVE-2025-65018), and an out-of-bounds read in the png_image_read_composite function (CVE-2025-66293). These issues could potentially lead to memory corruption when processing PNG image files. Red Hat Product Security has released updated libpng packages to remediate these vulnerabilities. The advisory RHSA-2026:0241 provides details on the affected versions and the availability of patches. The vulnerabilities are rated with an important security impact by Red Hat, and no CVSS scores are provided in the advisory.

The vulnerabilities in libpng could allow an attacker to cause memory corruption through specially crafted PNG files, potentially leading to application crashes or other unintended behavior. However, there are no reports of active exploitation in the wild. The impact is rated as important by Red Hat, indicating a significant security concern but not necessarily critical. The issues affect multiple architectures and versions of Red Hat Enterprise Linux 8.

Red Hat has released updated libpng packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8 should apply the security update described in advisory RHSA-2026:0241 as soon as possible. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual patching by system administrators. No additional mitigation steps are indicated by the vendor advisory.