Skip to content
OpenAdvisories
High DSA-6076-1 5 CVEs

libpng1.6 - security update

Published Dec 10, 2025 · Updated Dec 10, 2025

Fixed packages 2

ReleasePackageFixed in
Debian · 12 libpng1.6 1.6.39-2+deb12u1
Debian · 13 libpng1.6 1.6.48-1+deb13u1

Vulnerabilities 5

  • High 7.1
    CVE-2025-64720 Public exploit

    LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…

  • High 7.1
    CVE-2025-65018 Public exploit

    LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…

  • High 7.1

    LIBPNG has an out-of-bounds read in png_image_read_composite

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond …

  • Medium 6.1

    LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when process…

  • Medium 6.1

    LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit func…