The vulnerability (CVE-2025-65018) is a heap buffer overflow in the libpng library's png_image_finish_read function triggered by processing 16-bit interlaced PNG images with an 8-bit output format. This causes heap writes beyond allocated buffer bounds, potentially allowing an attacker to crash applications or execute arbitrary code. The issue affects Red Hat Hardened Images RPMs including libpng-1.6.56-1.hum1 for aarch64 and x86_64 architectures. Red Hat classifies this as an important vulnerability with a CVSS v3 base score of 7.1 (local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity and availability impact). No official patch or mitigation is currently available that meets Red Hat's standards for deployment and stability. The vulnerability is tracked under Red Hat Advisory RHSA-2026:6732 and is part of a set of related CVEs addressed in this advisory.

Successful exploitation can lead to application crashes (denial of service) or arbitrary code execution due to heap buffer overflow and out-of-bounds memory writes. The integrity and availability of affected systems can be compromised. Exploitation requires processing a malicious PNG file, which may be done by a user or automated system. No confidentiality impact is reported. The vulnerability affects the stability and security of applications using the vulnerable libpng version in Red Hat Hardened Images.

Currently, no mitigation or workaround meets Red Hat Product Security criteria for ease of use, deployment, applicability, or stability. Users are advised to monitor Red Hat advisories for updates. Upgrading to a fixed version when available is recommended. Customers with Red Hat Technical Account Managers can seek direct guidance. Avoid processing untrusted or suspicious PNG files until a fix is released.