The libpng library in Red Hat Enterprise Linux 9.0 contains three security vulnerabilities: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These issues can lead to denial of service and potential information leakage. Red Hat has released updated libpng packages to address these vulnerabilities as detailed in advisory RHSA-2026:3573.

The vulnerabilities can cause denial of service conditions and information disclosure when processing PNG images using libpng. The heap buffer over-read and overflow issues may allow attackers to read or corrupt memory, potentially leading to application crashes or leakage of sensitive information. The advisory rates the security impact as important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated libpng packages for Red Hat Enterprise Linux 9.0 that address these vulnerabilities. Users should apply these official updates as described in Red Hat advisory RHSA-2026:3573 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.