Threat Intelligence Database

A vulnerability in libpng version 1.8.0 involves an interpretation conflict in the APNG parser's handling of ancillary chunks. Specifically, certain discard paths clear the chunk-header flag without consuming the chunk body and CRC, which may allow attacker-controlled data to be misinterpreted as new chunk headers. This issue is identified as CWE-436 and has a CVSS score of 5.4, indicating medium severity.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.

An out-of-bounds read and write vulnerability exists in libpng versions 1.6.36 through 1.6.55 in the ARM/AArch64 Neon-optimized palette expansion code. This occurs when expanding 8-bit paletted rows to RGB or RGBA, where the Neon loop processes a final partial chunk without verifying input pixel boundaries, causing pointer underflow and memory corruption. The issue can be triggered by decoding attacker-controlled PNG files if Neon is enabled. Version 1.6.56 addresses this vulnerability.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.

CVE-2026-3713 is a heap-based buffer overflow vulnerability in the pnggroup libpng library up to version 1.6.55. It affects the function do_pnm2png in the file contrib/pngminus/pnm2png.c, where manipulation of the width and height arguments can cause the overflow. Exploitation requires local access and no user interaction. Although an exploit has been published, the project has not yet responded with a fix.

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-28162

CVE-2025-28164 is a medium severity buffer overflow vulnerability in libpng versions 1.6.43 through 1.6.46. It allows a local attacker with low privileges to cause a denial of service by exploiting the png_create_read_struct() function. The vulnerability does not impact confidentiality or integrity but can disrupt availability by crashing applications that process PNG images. Exploitation requires local access and no user interaction is needed. No known public exploits exist yet, and no patches have been linked. European organizations using affected libpng versions in local image processing or software relying on libpng could face service interruptions.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-28164

CVE-2026-22801 is a medium severity vulnerability in libpng versions prior to 1.6.54, involving an out-of-bounds read caused by integer truncation in the simplified write API functions. Specifically, when a negative row stride or a stride exceeding 65535 bytes is provided, a heap buffer over-read occurs. This bug was introduced in libpng 1.6.26 due to casts intended to silence compiler warnings on 16-bit systems. The vulnerability affects applications that use libpng to read, create, or manipulate PNG images and can lead to denial of service due to application crashes. No known exploits are currently reported in the wild. The vulnerability requires local access to trigger (attack vector: local), does not require privileges or user interaction, and impacts availability primarily.

MediumVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-22801#cwe-125

CVE-2026-22695 is a medium severity heap buffer over-read vulnerability in the libpng library versions 1.6.51 to 1.6.53. It occurs in the png_image_finish_read function when processing interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This vulnerability is a regression introduced by a previous fix and can lead to denial of service due to application crashes. Exploitation requires local access and user interaction, with no known exploits in the wild. The issue is fixed in libpng version 1.6.

MediumVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-22695#cwe-125

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

HighVulnerabilityGermanyFranceUnited Kingdom+6#cve#cve-2025-66293#cwe-125