The Red Hat security advisory RHSA-2026:4306 addresses three vulnerabilities in the mingw-libpng package for Red Hat Enterprise Linux 8. CVE-2026-22801 involves information disclosure and denial of service caused by integer truncation in the simplified write API. CVE-2026-22695 involves denial of service and information disclosure due to a heap buffer over-read in the png_image_finish_read function. CVE-2026-25646 is a heap buffer overflow vulnerability in the png_set_quantize function. These vulnerabilities could allow attackers to cause denial of service or leak information. The advisory provides updated packages to remediate these issues.

The vulnerabilities can lead to information disclosure and denial of service conditions in affected systems running the mingw-libpng library. Specifically, integer truncation and heap buffer over-read issues may expose sensitive data or crash applications using the library. The heap buffer overflow could potentially cause application crashes or other undefined behavior. No known exploits in the wild have been reported at this time.

Red Hat has released updated mingw-libpng packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:4306 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed as an official fix available from Red Hat.