Summary
It was discovered that libpng did not properly handle memory when processing
certain PNG files. An attacker could possibly use this issue to cause libpng
to crash, resulting in a denial of service, or disclose sensitive information.
(CVE-2025-64505)
Joshua Inscoe discovered that libpng did not properly handle memory when
processing certain PNG files. An attacker could possibly use this issue
to cause libpng to crash, resulting in a denial of service, disclose sensitive
information, or execute arbitrary code. (CVE-2026-25646)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libpng | 1.2.50-1ubuntu2.14.04.3+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libpng | 1.2.54-1ubuntu1.1+esm2 |
Vulnerabilities 2
-
High 8.3
LIBPNG has a heap buffer overflow in png_set_quantize
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function i…
-
Medium 6.1
LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when process…