The libpng library in Red Hat Enterprise Linux 8.6 contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service through integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure via a heap buffer over-read in the png_image_finish_read function; and CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could allow an attacker to cause denial of service or leak sensitive information when processing PNG images. Red Hat has issued a security advisory (RHSA-2026:4730) and released updated libpng packages to fix these issues.

Successful exploitation of these vulnerabilities could lead to denial of service conditions or information disclosure on affected systems running vulnerable versions of libpng. The issues stem from memory handling errors such as integer truncation, heap buffer over-read, and heap buffer overflow. These flaws may be triggered by processing specially crafted PNG images. The vulnerabilities are rated as important by Red Hat, indicating a high security impact but no confirmed exploits in the wild have been reported.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:4730 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated by the vendor beyond applying the official patch.