The libpng library in Red Hat Enterprise Linux 8.8 contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in png_set_quantize. These vulnerabilities can lead to denial of service and potential information leakage. Red Hat has issued an important security advisory (RHSA-2026:4729) with updated libpng packages to address these issues.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service conditions and potentially disclose sensitive information by exploiting integer truncation, heap buffer over-read, and heap buffer overflow flaws in libpng. These issues affect systems running Red Hat Enterprise Linux 8.8 with the vulnerable libpng versions.

Red Hat has released updated libpng packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 8.8 should apply the security update described in advisory RHSA-2026:4729 promptly. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.