libpng: LIBPNG out-of-bounds read in png_image_read_composite

An out of bounds read vulnerability has been discovered in libpng. This vulnerability is in libpng's simplified API allows reading up to 1012 bytes beyond the pngsRGBbase512 array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger...

ROS-20260401-73-0010

A vulnerability in the pngimagereaddirectscaled function of the libpng library is related to reading data outside of buffer boundaries in memory. Exploitation of the vulnerability may allow an attacker to gain unauthorized access to protected information or cause denial of service...

ROS-20260401-73-0007

A vulnerability in the pngimagereadcomposite function of the libpng library is related to reading data outside of buffer boundaries in memory. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality and availability of protected information using a specially...

Fedora 43 : libpng (2026-a9ae661fa2)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9ae661fa2 advisory. Version 1.6.54 January 12, 2026 Fixed CVE-2026-22695 medium severity: Heap buffer over-read in pngimagereaddirectscaled. Fixed CVE-2026-22801 medium...

Alibaba Cloud Linux 3 : 0007: mingw-libpng (ALINUX3-SA-2026:0007)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0007 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-64720: LIBPNG is a reference...

LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)

...

RHEL 9 : libpng (RHSA-2026:0211)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0211 advisory. The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics PNG image format files. Security...

libpng: LIBPNG buffer overflow

A buffer overflow flaw has been discovered in libpng. An out-of-bounds read vulnerability exists in pngimagereadcomposite when processing palette images with PNGFLAGOPTIMIZEALPHA enabled. The palette compositing code in pnginitreadtransformations incorrectly applies background compositing during...

libpng: LIBPNG out-of-bounds read in png_image_read_composite

An out of bounds read vulnerability has been discovered in libpng. This vulnerability is in libpng's simplified API allows reading up to 1012 bytes beyond the pngsRGBbase512 array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger...

libpng: LIBPNG out-of-bounds read in png_image_read_composite

An out of bounds read vulnerability has been discovered in libpng. This vulnerability is in libpng's simplified API allows reading up to 1012 bytes beyond the pngsRGBbase512 array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger...

libpng security update

2:1.6.37-12.1 - CVE-2025-64720: buffer overflow RHEL-131580 - CVE-2025-65018: heap buffer overflow RHEL-131593 - CVE-2025-66293: out-of-bounds read in pngimagereadcomposite RHEL-133287...

SUSE SLES15: libpng16-16 / libpng16-16-32bit / libpng16-compat-devel / etc (SUSE-SU-2025:4436-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4436-1 advisory. - CVE-2025-65018: Fixed heap buffer overflow in pngcombinerow triggered via pngimagefinishread bsc1254160 - CVE-2025-66293: Fixed...

MGASA-2025-0323 Updated libpng packages fix security vulnerability

LIBPNG has an out-of-bounds read in pngimagereadcomposite. CVE-2025-66293...

Updated libpng packages fix security vulnerability

LIBPNG has an out-of-bounds read in pngimagereadcomposite. CVE-2025-66293...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the pngimagereadcomposite function when processing valid palette PNG images with partial transparency and gamma correction. An attacker can cause information disclosure or...

CVE-2025-65018

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function pngimagefinishread when processing...