CVE-2026-25646

LIBPNG has a bug in the png_set_quantize() API prior to 1.6.55: when called with no histogram and the palette colors exceed twice the display’s maximum, certain palettes can cause an out-of-bounds read that may read past an internal heap buffer, potentially causing an infinite loop. The issue is ...

CVE-2026-25646 LIBPNG has a heap buffer overflow in png_set_quantize

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the pngsetquantize API function. When the function is called with no histogram and the number of...

png -- CWE-122: Heap-based Buffer Overflow

https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3 reports: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the...

CVE-2026-22801 affecting package libpng for versions less than 1.6.54-1

CVE-2026-22801 affecting package libpng for versions less than 1.6.54-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-22695 affecting package libpng for versions less than 1.6.54-1

CVE-2026-22695 affecting package libpng for versions less than 1.6.54-1. An upgraded version of the package is available that resolves this issue...

MiracleLinux 9 : java-25-openjdk-25.0.2.0.10-1.el9.ML.1 (AXSA:2026-154:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-154:04 advisory. JDK: Improve JMX connections CVE-2026-21925 JDK: Improve HttpServer Request handling CVE-2026-21933 JDK: Enhance Certificate Checking CVE-2026-21945...

OESA-2026-1316 libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fixes: Buffer Overflow vulnerabili...

OESA-2026-1315 libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fixes: Buffer Overflow vulnerabili...

OESA-2026-1314 libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fixes: Buffer Overflow vulnerabili...

OESA-2026-1313 libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fixes: Buffer Overflow vulnerabili...

CVE-2026-22801 affecting package libpng for versions less than 1.6.54-1

CVE-2026-22801 affecting package libpng for versions less than 1.6.54-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-22695 affecting package libpng for versions less than 1.6.54-1

CVE-2026-22695 affecting package libpng for versions less than 1.6.54-1. An upgraded version of the package is available that resolves this issue...

Amazon Linux 2023 : libpng, libpng-devel, libpng-static (ALAS2023-2026-1390)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1390 advisory. LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-rea...

Medium: libpng

Issue Overview: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function pngimagefinishread when processing interlaced...

CLSA-2026-1770116781 java-1.8.0-openjdk: Fix of 5 CVEs

CVE-2026-21945: security component vulnerability allowing unauthenticated attackers with network access to cause denial of service - CVE-2026-21933: networking component vulnerability allowing unauthenticated attackers with network access to compromise confidentiality and integrity -...

CLSA-2026-1770115899 java-17-openjdk: Fix of 5 CVEs

Update to jdk-17.0.18+8 GA - CVE-2026-21925: improve JMX connections - CVE-2026-21933: improve HttpServer Request handling - CVE-2026-21945: enhance Certificate Checking - CVE-2025-64720: libpng: fix buffer overflow - CVE-2025-65018: libpng: fix heap buffer overflow...

Security update for libpng16

This update for libpng16 fixes the following issues: CVE-2025-28162: memory leaks when running pngimage bsc1257364. CVE-2025-28164: memory leaks when running pngimage bsc1257365. CVE-2026-22695: Fixed heap buffer over-read in pngimagefinishread bsc1256525. Patch Instructions: To install this SUSE...

Huawei EulerOS: Security Advisory for libpng (EulerOS-SA-2026-1225)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 24.04 LTS : libpng vulnerabilities (USN-7993-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7993-1 advisory. It was discovered that libpng incorrectly handled memory when processing certain malformed PNG files. If a user or automated system were tricked into...

Ubuntu: Security Advisory (USN-7993-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...