Search: CVE-2026-22801

CVE-2026-22801 is a medium severity vulnerability in libpng versions prior to 1.6.54, involving an out-of-bounds read caused by integer truncation in the simplified write API functions. Specifically, when a negative row stride or a stride exceeding 65535 bytes is provided, a heap buffer over-read occurs. This bug was introduced in libpng 1.6.26 due to casts intended to silence compiler warnings on 16-bit systems. The vulnerability affects applications that use libpng to read, create, or manipulate PNG images and can lead to denial of service due to application crashes. No known exploits are currently reported in the wild. The vulnerability requires local access to trigger (attack vector: local), does not require privileges or user interaction, and impacts availability primarily.