The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.

Security Fix(es):

* libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801)

* libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695)

* libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: libpng security update

Multiple security vulnerabilities have been identified in the libpng library used in Red Hat Enterprise Linux 8.2 AUS. These include information disclosure and denial of service via integer truncation in the simplified write API, denial of service and information disclosure via heap buffer over-read in png_image_finish_read, and a heap buffer overflow in png_set_quantize. A security update addressing these issues is available from Red Hat.

This update for libpng16 fixes the following issues:

- CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525).
- CVE-2026-22801: Fixed integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526).

security update for libpng

MinGW Windows Libpng library.

Security Fix(es):

* libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801)

* libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695)

* libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

security update for mingw-libpng

Multiple vulnerabilities in the libpng library's simplified API can cause denial of service (DoS) by crashing the library when processing specially crafted PNG files. These issues involve incorrect handling of palette PNG images with partial transparency and gamma correction, interlaced 16-bit PNGs with 8-bit output format and non-minimal row strides, invalid row strides, and quantizing RGB images. The vulnerabilities affect various Ubuntu releases and have been addressed through package updates.

libpng (API-Funktionen): Mehrere Schwachstellen ermöglichen DoS und Offenlegung von Informationen

libpng

CVE-2026-22695 is a medium severity heap buffer over-read vulnerability in the libpng library versions 1.6.51 to 1.6.53. It occurs in the png_image_finish_read function when processing interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This vulnerability is a regression introduced by a previous fix and can lead to denial of service due to application crashes. Exploitation requires local access and user interaction, with no known exploits in the wild. The issue is fixed in libpng version 1.6.

Search: CVE-2026-22695