The libpng library in Red Hat Enterprise Linux 10.0 Extended Update Support contains three distinct security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could allow attackers to cause denial of service or leak information by processing specially crafted PNG files. Red Hat has released updated libpng packages to address these issues.

Successful exploitation of these vulnerabilities could result in denial of service conditions and information disclosure on affected systems running Red Hat Enterprise Linux 10.0 Extended Update Support. The heap buffer overflow could potentially lead to memory corruption. These issues affect the libpng library functions responsible for reading and writing PNG images, which may be used by various applications and services.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:3577 and the associated article https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.