Skip to content
OpenAdvisories
Medium ALAS2023-2026-1440 2 CVEs

Moderate: libpng security update (Amazon Linux 2023)

Published Feb 16, 2026 · Updated Feb 18, 2026

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-28164: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function. CVE-2025-28162: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 libpng 2:1.6.37-10.amzn2023.0.10
Amazon Linux · 2023 libpng-debuginfo 2:1.6.37-10.amzn2023.0.10
Amazon Linux · 2023 libpng-debugsource 2:1.6.37-10.amzn2023.0.10
Amazon Linux · 2023 libpng-devel 2:1.6.37-10.amzn2023.0.10
Amazon Linux · 2023 libpng-devel-debuginfo 2:1.6.37-10.amzn2023.0.10
Amazon Linux · 2023 libpng-static 2:1.6.37-10.amzn2023.0.10
Amazon Linux · 2023 libpng-tools 2:1.6.37-10.amzn2023.0.10
Amazon Linux · 2023 libpng-tools-debuginfo 2:1.6.37-10.amzn2023.0.10

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-28162.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-28164.html