The libpng library in Red Hat Enterprise Linux 9 contains multiple security flaws: a buffer overflow (CVE-2025-64720), a heap buffer overflow (CVE-2025-65018), and an out-of-bounds read in the png_image_read_composite function (CVE-2025-66293). These issues could potentially lead to memory corruption or crashes when processing PNG images. Red Hat has released updated libpng packages to fix these vulnerabilities as detailed in advisory RHSA-2026:0238. The advisory covers multiple architectures and product variants of Red Hat Enterprise Linux 9. No CVSS scores are provided in the advisory, but the severity is rated as Important.

The vulnerabilities could allow an attacker to cause memory corruption or read out-of-bounds memory when processing specially crafted PNG files, potentially leading to denial of service or other impacts depending on the context of use. The advisory does not report known exploits in the wild. The impact is considered important but not critical according to Red Hat's rating.

Red Hat has released updated libpng packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9 versions should apply the security update as described in Red Hat advisory RHSA-2026:0238 and the linked article https://access.redhat.com/articles/11258. This update is the official fix and remediation for these issues. No additional mitigation steps are indicated by the vendor.