This advisory covers three distinct vulnerabilities in the mingw-libpng package: CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API; CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function; CVE-2026-25646 is a heap buffer overflow in the png_set_quantize function. These vulnerabilities affect the MinGW Windows Libpng library distributed with Red Hat Enterprise Linux 8 and related products. The advisory references fixes available in updated package versions.

The vulnerabilities can lead to information disclosure and denial of service conditions. Specifically, integer truncation and heap buffer over-read issues may expose sensitive data or cause application crashes. The heap buffer overflow may allow memory corruption, potentially leading to denial of service or other impacts. These issues affect applications using the vulnerable libpng library in the affected Red Hat products.

Red Hat has released updated mingw-libpng packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:4306 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.