Log in / Sign up

Vulnerability details

CVE-2026-25646

Red Hat Enterprise Linux 6Red Hat Enterprise Linux 9pnggroup libpng

LIBPNG has a heap buffer overflow in png_set_quantize

CVSS 4.0
8.3High

Official description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

CVSS scores

ScoreVersionSourceVector
8.3High 4.0 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
7.0High 3.1 CVEProject cvelistV5 (CNA) (redhat-SADP) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

VendorProductVersionsSource
Red Hat Red Hat Enterprise Linux 6 All CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 9 All CVEProject cvelistV5 (CNA)
pnggroup libpng < 1.6.55 CVEProject cvelistV5 (CNA)

References and advisories

51
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-02-10
Last updated
2026-09-01
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

1.12%
Probability of exploitation in 30 days
66.3%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-122
    Heap-based Buffer Overflow
  • CWE-126
    Buffer Over-read
  • CWE-125
    Out-of-bounds Read