Skip to content
OpenAdvisories
High USN-8035-1 4 CVEs

libpng1.6 vulnerabilities

Published Feb 12, 2026 · Updated Oct 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the libpng simplified API incorrectly processed
palette PNG images with partial transparency and gamma correction. If a
user or automated system were tricked into opening a specially crafted PNG
file, an attacker could use this issue to cause libpng to crash, resulting
in a denial of service. (CVE-2025-66293)

Petr Simecek, Stanislav Fort and Pavel Kohout discovered that the libpng
simplified API incorrectly processed interlaced 16-bit PNGs with 8-bit
output format and non-minimal row strides. If a user or automated system
were tricked into opening a specially crafted PNG file, an attacker could
use this issue to cause libpng to crash, resulting in a denial of service.
(CVE-2026-22695)

Cosmin Truta discovered that the libpng simplified API incorrectly handled
invalid row strides. If a user or automated system were tricked into
opening a specially crafted PNG file, an attacker could use this issue to
cause libpng to crash, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-22801)

It was discovered that the libpng simplified API incorrectly handled
quantizing RGB images. If a user or automated system were tricked into
opening a specially crafted PNG file, an attacker could use this issue to
cause libpng to crash, resulting in a denial of service. (CVE-2026-25646)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libpng1.6 1.6.20-2ubuntu0.1~esm3
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libpng1.6 1.6.34-1ubuntu0.18.04.2+esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS libpng1.6 1.6.37-2ubuntu0.1~esm2

Vulnerabilities 4

  • High 8.3
    CVE-2026-25646

    LIBPNG has a heap buffer overflow in png_set_quantize

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function i…

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.1
    CVE-2025-66293

    LIBPNG has an out-of-bounds read in png_image_read_composite

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond …

    pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.8
    CVE-2026-22801

    LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bi…

    pnggroup libpng fltk libpng1.6 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.1
    CVE-2026-22695

    LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read whe…

    pnggroup libpng libpng1.6 libpng1.6 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2025-66293
  • report
    https://ubuntu.com/security/CVE-2026-22695
  • report
    https://ubuntu.com/security/CVE-2026-22801
  • report
    https://ubuntu.com/security/CVE-2026-25646