The Red Hat security advisory RHSA-2026:4306 reports three vulnerabilities in the mingw-libpng package used in Red Hat Enterprise Linux 8. CVE-2026-22801 involves information disclosure and denial of service through integer truncation in the simplified write API. CVE-2026-22695 describes denial of service and information disclosure caused by a heap buffer over-read in the png_image_finish_read function. CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These issues relate to improper memory handling and can lead to denial of service or information leakage. Red Hat has released updated packages to address these vulnerabilities. The advisory references the official Red Hat article for update instructions and lists affected packages and versions.

The vulnerabilities can lead to denial of service conditions and information disclosure due to improper memory handling in the libpng library. Specifically, integer truncation and heap buffer over-read or overflow issues may allow an attacker to cause application crashes or leak sensitive information processed by the library. These impacts affect applications using the mingw-libpng package on Red Hat Enterprise Linux 8. No known active exploitation has been reported.

Red Hat has released updated mingw-libpng packages that fix the reported vulnerabilities. Users of affected Red Hat Enterprise Linux 8 systems should apply the security update as described in the Red Hat advisory RHSA-2026:4306 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.