The libpng library in Red Hat Enterprise Linux 8.6 contains three notable vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could potentially allow attackers to cause denial of service or leak information by processing crafted PNG files. Red Hat has released updated libpng packages to address these issues.

These vulnerabilities can lead to denial of service conditions and information disclosure when processing specially crafted PNG images using the affected libpng library versions in Red Hat Enterprise Linux 8.6. The heap buffer overflow could also potentially be exploited to cause more severe memory corruption. No known exploits in the wild have been reported at this time.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 8.6 variants that fix these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:4730 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated by the vendor.