The libpng library in Red Hat Enterprise Linux 9.2 contains three distinct security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; and CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities can lead to denial of service conditions and potential leakage of sensitive information. Red Hat has released updated libpng packages to remediate these issues.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service conditions and potentially disclose sensitive information by manipulating PNG image processing. The heap buffer overflow could also lead to memory corruption. These issues affect systems using the vulnerable libpng versions in Red Hat Enterprise Linux 9.2, potentially impacting applications that process PNG images.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:3575 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation is required beyond applying the official patch.