Skip to content
OpenAdvisories
High RHSA-2026:6732 13 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Apr 20, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 libpng 0:1.6.56-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libpng-devel 0:1.6.56-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libpng-static 0:1.6.56-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libpng-tools 0:1.6.56-1.hum1

Vulnerabilities 13

  • High 8.3
    CVE-2026-25646

    LIBPNG has a heap buffer overflow in png_set_quantize

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function i…

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.6
    CVE-2026-33636

    LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palett…

    pnggroup libpng fltk libpng1.6 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-33416

    LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_str…

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.1
    CVE-2025-64720 Public exploit

    LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.1
    CVE-2025-65018 Public exploit

    LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.1
    CVE-2025-66293

    LIBPNG has an out-of-bounds read in png_image_read_composite

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond …

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.8
    CVE-2026-22801

    LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bi…

    pnggroup libpng fltk libpng1.6 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.1
    CVE-2025-64505

    LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when process…

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.1
    CVE-2025-64506

    LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit func…

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.1
    CVE-2026-22695

    LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read whe…

    pnggroup libpng libpng1.6 libpng1.6 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.5
    CVE-2025-28162

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngi…

    libpng1.6 libpng1.6 Debian Ubuntu
  • Medium 5.5
    CVE-2025-28164

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_crea…

    libpng1.6 libpng1.6 Debian Ubuntu
  • Medium 5.3
    CVE-2026-3713

    pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow

    A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow.…

    pnggroup libpng tensorflow libpng1.6 Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2025-65018
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2025-64720
  • report
    https://access.redhat.com/security/cve/CVE-2025-64506
  • report
    https://access.redhat.com/security/cve/CVE-2025-64505
  • report
    https://access.redhat.com/security/cve/CVE-2026-22801
  • report
    https://access.redhat.com/security/cve/CVE-2026-22695
  • report
    https://access.redhat.com/security/cve/CVE-2025-28164
  • report
    https://access.redhat.com/security/cve/CVE-2025-28162
  • report
    https://access.redhat.com/security/cve/CVE-2026-33636
  • report
    https://access.redhat.com/security/cve/CVE-2026-33416
  • report
    https://access.redhat.com/security/cve/CVE-2025-66293
  • report
    https://access.redhat.com/security/cve/CVE-2026-3713
  • report
    https://access.redhat.com/security/cve/CVE-2026-25646
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6732.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2433407
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-28162
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-28162
  • article
    https://gist.github.com/kittener/fbfdb9b5610c6b3db0d5dea045a07c60
  • article
    https://github.com/pnggroup/libpng/issues/656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2433398
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-28164
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-28164
  • article
    https://gist.github.com/kittener/506516f8c22178005b4379c8b2a7de20
  • article
    https://github.com/pnggroup/libpng/issues/655
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2416905
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-64505
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-64505
  • article
    https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37
  • article
    https://github.com/pnggroup/libpng/pull/748
  • article
    https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2416906
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-64506
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-64506
  • article
    https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821
  • article
    https://github.com/pnggroup/libpng/pull/749
  • article
    https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2416904