The libpng library, which provides functions for creating and manipulating PNG image files, contains three security vulnerabilities: a buffer overflow (CVE-2025-64720), a heap buffer overflow (CVE-2025-65018), and an out-of-bounds read vulnerability in the png_image_read_composite function (CVE-2025-66293). These issues affect Red Hat Enterprise Linux 8.4 Advanced Update Support and Extended Update Support variants. Red Hat has released updated libpng packages to fix these vulnerabilities as detailed in security advisory RHSA-2026:0321. The vulnerabilities correspond to CWE-125 (out-of-bounds read) and CWE-787 (out-of-bounds write). No CVSS scores are provided in the advisory, but the impact is considered important by Red Hat.

Successful exploitation of these vulnerabilities could lead to memory corruption conditions such as buffer overflows and out-of-bounds reads within applications using the libpng library. This may result in application crashes or potentially allow an attacker to execute arbitrary code or cause denial of service. However, no known exploits in the wild have been reported. The vulnerabilities affect Red Hat Enterprise Linux 8.4 variants including Advanced Mission Critical Update Support and Extended Update Support.

Red Hat has released updated libpng packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 8.4 variants should apply the security update provided in advisory RHSA-2026:0321. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is an on-premises product, remediation requires manual update by system administrators. There is no indication that the vulnerabilities are already mitigated or require no action.