The Red Hat security advisory RHSA-2026:0125 reports three vulnerabilities in the mingw-libpng package for Red Hat Enterprise Linux 8. These include a buffer overflow (CVE-2025-64720), a heap buffer overflow (CVE-2025-65018), and an out-of-bounds read vulnerability (CVE-2025-66293) within the libpng library used in MinGW Windows environments. These vulnerabilities relate to improper memory handling, specifically buffer and heap overflows and out-of-bounds reads, which could lead to potential memory corruption or crashes. Red Hat has released updated packages to address these issues, and detailed patch instructions are available in their advisory. The vulnerabilities are rated as having an important security impact by Red Hat Product Security.

The vulnerabilities could allow an attacker to cause memory corruption through buffer overflow or out-of-bounds read conditions in the libpng library, potentially leading to application crashes or other unintended behavior. While no known exploits are currently reported in the wild, the issues are considered significant enough to warrant an important security update. The affected software is used in Red Hat Enterprise Linux 8 environments, particularly in the CodeReady Linux Builder for x86_64.

Red Hat has released updated packages for mingw-libpng that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:0125 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update. Patch status is confirmed as an official fix available from Red Hat.