The libpng12 package, which provides version 1.2 of the libpng library for handling PNG image files, contains a heap buffer overflow vulnerability in the png_set_quantize function (CVE-2026-25646). This vulnerability could potentially lead to memory corruption when processing PNG images. Red Hat has released updated libpng12 packages for affected versions of Red Hat Enterprise Linux 8.4 to remediate this issue. The advisory classifies the security impact as Important (high severity).

The heap buffer overflow in png_set_quantize could allow an attacker to cause memory corruption, which may lead to application crashes or potentially arbitrary code execution depending on the context in which the library is used. The advisory does not provide details of active exploitation or specific attack vectors. The vulnerability affects systems running Red Hat Enterprise Linux 8.4 with the libpng12 package installed.

Red Hat has released updated libpng12 packages that fix the heap buffer overflow vulnerability. Users of affected Red Hat Enterprise Linux 8.4 versions should apply the security update as described in Red Hat advisory RHSA-2026:7036. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.