The libpng library in Red Hat Enterprise Linux 7 Extended Lifecycle Support contains a buffer overflow vulnerability identified as CVE-2025-64720, classified under CWE-125 (Out-of-bounds Read). This vulnerability arises from improper handling of PNG image data, potentially leading to memory corruption. Red Hat Product Security has released an advisory (RHSA-2026:0251) with updated libpng packages to fix this issue. The advisory marks the severity as Important and provides detailed package updates for multiple architectures. No CVSS score is provided in the advisory, and no known exploitation has been reported. The vendor recommends applying the update as detailed in their official documentation.

The vulnerability could allow an attacker to cause a buffer overflow in the libpng library, which may lead to memory corruption. This could potentially be exploited to cause denial of service or other unintended behavior in applications processing PNG files using the vulnerable libpng versions. However, no known exploits in the wild have been reported. The impact is rated as Important by Red Hat, indicating a significant security concern but not necessarily critical.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address this buffer overflow vulnerability. Users should apply these official updates as described in the Red Hat advisory RHSA-2026:0251 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerability. No additional mitigation steps are indicated by the vendor.