The libpng library in Red Hat Enterprise Linux 9.6 Extended Update Support contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; and CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could allow an attacker to cause denial of service or leak sensitive information. Red Hat has issued an important security advisory (RHSA-2026:3576) with updates to fix these issues.

Successful exploitation of these vulnerabilities could lead to denial of service conditions and information disclosure on affected systems running Red Hat Enterprise Linux 9.6 Extended Update Support. The vulnerabilities affect the libpng library functions that process PNG images, potentially allowing crafted PNG files to trigger these issues.

Red Hat has released updated libpng packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.6 Extended Update Support should apply the security update as described in Red Hat advisory RHSA-2026:3576 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.