Skip to content
OpenAdvisories
High · 7.1 Public exploit CVE-2025-64720 EUVD-2025-199237

LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

Published Nov 24, 2025 · Updated Nov 25, 2025 · Assigned by GitHub_M

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.

Affected products

VendorProductAffectedFixed
pnggroup libpng >= 1.6.0, < 1.6.51 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libpng1.6 1.6.51-1 —
Debian 13 libpng1.6 1.6.48-1+deb13u1 DSA-6076-1
Debian 12 libpng1.6 1.6.39-2+deb12u1 DSA-6076-1
Debian 11 libpng1.6 1.6.37-3+deb11u1 DLA-4396-1
ReleasePackageFixed inAdvisory
Ubuntu 25.10 libpng1.6 1.6.50-1ubuntu0.1 —
Ubuntu 24.04 LTS libpng1.6 1.6.43-5ubuntu0.1 —
Ubuntu 22.04 LTS libpng1.6 1.6.37-3ubuntu0.1 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libpng1.6 1.6.37-2ubuntu0.1~esm1 —
Ubuntu Pro 18.04 LTS libpng1.6 1.6.34-1ubuntu0.18.04.2+esm1 —
Ubuntu Pro 16.04 LTS libpng1.6 1.6.20-2ubuntu0.1~esm2 —
ReleasePackageFixed inAdvisory
RHEL 10 java-21-openjdk +22 1:21.0.10.0.7-1.el10 RHSA-2026:0928
RHEL 10 java-25-openjdk +25 1:25.0.2.0.10-1.el10 RHSA-2026:0933
RHEL 10 libpng +1 2:1.6.40-8.el10_1.1 RHSA-2026:0237
RHEL 9 java-1.8.0-openjdk +16 1:1.8.0.482.b08-1.el9 RHSA-2026:0932
RHEL 9 java-17-openjdk +22 1:17.0.18.0.8-1.el9 RHSA-2026:0927
RHEL 9 java-21-openjdk +22 1:21.0.10.0.7-1.el9 RHSA-2026:0928
RHEL 9 java-25-openjdk +25 1:25.0.2.0.10-1.el9 RHSA-2026:0933
RHEL 9 libpng +1 2:1.6.37-12.el9_7.1 RHSA-2026:0238
RHEL 8 java-1.8.0-openjdk +19 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8 java-17-openjdk +22 1:17.0.18.0.8-1.el8 RHSA-2026:0927
RHEL 8 java-21-openjdk +22 1:21.0.10.0.7-1.el8 RHSA-2026:0928
RHEL 8 libpng +1 2:1.6.34-9.el8_10 RHSA-2026:0241
RHEL 8 mingw-libpng +4 1.6.34-1.el8_10 RHSA-2026:0125
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS java-21-openjdk +22 1:21.0.10.0.7-1.el10 RHSA-2026:0928
RHEL 10.0 EUS libpng +1 2:1.6.40-8.el10_0.1 RHSA-2026:0212
RHEL 9.6 EUS java-1.8.0-openjdk +16 1:1.8.0.482.b08-1.el9 RHSA-2026:0932
RHEL 9.6 EUS java-17-openjdk +22 1:17.0.18.0.8-1.el9 RHSA-2026:0927
RHEL 9.6 EUS java-21-openjdk +22 1:21.0.10.0.7-1.el9 RHSA-2026:0928
RHEL 9.6 EUS libpng +1 2:1.6.37-12.el9_6.1 RHSA-2026:0210
RHEL 9.4 EUS java-1.8.0-openjdk +16 1:1.8.0.482.b08-1.el9 RHSA-2026:0932
RHEL 9.4 EUS java-17-openjdk +22 1:17.0.18.0.8-1.el9 RHSA-2026:0927
RHEL 9.4 EUS java-21-openjdk +22 1:21.0.10.0.7-1.el9 RHSA-2026:0928
RHEL 9.4 EUS libpng +1 2:1.6.37-12.el9_4.1 RHSA-2026:0211
RHEL 9.2 E4S java-1.8.0-openjdk +6 1:1.8.0.482.b08-1.el9 RHSA-2026:0932
RHEL 9.2 E4S java-17-openjdk +8 1:17.0.18.0.8-1.el9 RHSA-2026:0927
RHEL 9.2 E4S libpng +1 2:1.6.37-12.el9_2.1 RHSA-2026:0216
RHEL 9.0 E4S java-1.8.0-openjdk +6 1:1.8.0.482.b08-1.el9 RHSA-2026:0932
RHEL 9.0 E4S java-17-openjdk +8 1:17.0.18.0.8-1.el9 RHSA-2026:0927
RHEL 9.0 E4S libpng +1 2:1.6.37-12.el9_0.1 RHSA-2026:0234
RHEL 8.8 TUS java-1.8.0-openjdk +7 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8.8 TUS java-17-openjdk +8 1:17.0.18.0.8-1.el8 RHSA-2026:0927
RHEL 8.8 TUS libpng +1 2:1.6.34-8.el8_8.1 RHSA-2026:0313
RHEL 8.8 E4S java-1.8.0-openjdk +7 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8.8 E4S java-17-openjdk +8 1:17.0.18.0.8-1.el8 RHSA-2026:0927
RHEL 8.8 E4S libpng +1 2:1.6.34-8.el8_8.1 RHSA-2026:0313
RHEL 8.6 TUS java-1.8.0-openjdk +7 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8.6 TUS java-17-openjdk +8 1:17.0.18.0.8-1.el8 RHSA-2026:0927
RHEL 8.6 TUS libpng +1 2:1.6.34-8.el8_6.1 RHSA-2026:0322
RHEL 8.6 E4S java-1.8.0-openjdk +7 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8.6 E4S java-17-openjdk +8 1:17.0.18.0.8-1.el8 RHSA-2026:0927
RHEL 8.6 E4S libpng +1 2:1.6.34-8.el8_6.1 RHSA-2026:0322
RHEL 8.6 AUS java-1.8.0-openjdk +7 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8.6 AUS java-17-openjdk +8 1:17.0.18.0.8-1.el8 RHSA-2026:0927
RHEL 8.6 AUS libpng +1 2:1.6.34-8.el8_6.1 RHSA-2026:0322
RHEL 8.4 EUS Long Life java-1.8.0-openjdk +7 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8.4 EUS Long Life java-17-openjdk +22 1:17.0.18.0.8-1.el8 RHSA-2026:0927
RHEL 8.4 EUS Long Life libpng +1 2:1.6.34-8.el8_4.1 RHSA-2026:0321
RHEL 8.4 AUS java-1.8.0-openjdk +7 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8.4 AUS java-17-openjdk +8 1:17.0.18.0.8-1.el8 RHSA-2026:0927
RHEL 8.4 AUS libpng +1 2:1.6.34-8.el8_4.1 RHSA-2026:0321
RHEL 8.2 AUS java-1.8.0-openjdk +7 1:1.8.0.482.b08-1.el8 RHSA-2026:0932
RHEL 8.2 AUS libpng +1 2:1.6.34-8.el8_2.1 RHSA-2026:0323
RHEL 7 ELS libpng +2 2:1.5.13-8.el7_9.1 RHSA-2026:0251
Red Hat Openjdk Els 11 java-11-openjdk +17 1:11.0.30.0.7-1.el7_9 RHSA-2026:0847
Red Hat Openjdk Els 11 java-11-openjdk-fastdebug +13 1:11.0.30.0.7-1.el8 RHSA-2026:0847
Red Hat Hardened Images 1 libpng +3 1.6.56-1.hum1 RHSA-2026:80330, RHSA-2026:6732

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 java-21-openjdk +22 1:21.0.10.0.7-1.el10.alma.1 ALSA-2026:0928
AlmaLinux 10 java-25-openjdk +25 1:25.0.2.0.10-1.el10 ALSA-2026:0933
AlmaLinux 10 libpng +1 2:1.6.40-8.el10_1.1 ALSA-2026:0237
AlmaLinux 9 java-1.8.0-openjdk +16 1:1.8.0.482.b08-1.el9.alma.1 ALSA-2026:0932
AlmaLinux 9 java-17-openjdk +22 1:17.0.18.0.8-1.el9.alma.1 ALSA-2026:0927
AlmaLinux 9 java-21-openjdk +22 1:21.0.10.0.7-1.el9.alma.1 ALSA-2026:0928
AlmaLinux 9 java-25-openjdk +25 1:25.0.2.0.10-1.el9.alma.1 ALSA-2026:0933
AlmaLinux 9 libpng +1 2:1.6.37-12.el9_7.1 ALSA-2026:0238
AlmaLinux 8 java-1.8.0-openjdk +15 1:1.8.0.482.b08-1.el8 ALSA-2026:0932
AlmaLinux 8 java-17-openjdk +22 1:17.0.18.0.8-1.el8 ALSA-2026:0927
AlmaLinux 8 java-21-openjdk +22 1:21.0.10.0.7-1.el8 ALSA-2026:0928
AlmaLinux 8 libpng +1 2:1.6.34-9.el8_10 ALSA-2026:0241
AlmaLinux 8 mingw32-libpng +3 1.6.34-1.el8_10 ALSA-2026:0125

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 libpng 2:1.6.40-8.el10_1.1 RLSA-2026:0237
Rocky Linux 9 java-25-openjdk 1:25.0.2.0.10-1.el9 RLSA-2026:0933
Rocky Linux 9 libpng 2:1.6.37-12.el9_7.1 RLSA-2026:0238
Rocky Linux 8 java-1.8.0-openjdk 1:1.8.0.482.b08-1.el8 RLSA-2026:0932
Rocky Linux 8 java-17-openjdk 1:17.0.18.0.8-1.el8 RLSA-2026:0927
Rocky Linux 8 java-21-openjdk 1:21.0.10.0.7-1.el8 RLSA-2026:0928
Rocky Linux 8 libpng 2:1.6.34-9.el8_10 RLSA-2026:0241
Rocky Linux 8 mingw-libpng 1.6.34-1.el8_10 RLSA-2026:0125
ReleasePackageFixed inAdvisory
SLES 15 SP7 libpng16 1.6.40-150600.3.3.1 SUSE-SU-2025:4494-1
SLES 15 SP6 libpng16 1.6.40-150600.3.3.1 SUSE-SU-2025:4494-1
SLES 15 SP5 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLES 15 SP4 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLES 15 SP3 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
Show 19 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 libpng15 1.5.30-10.13.1 SUSE-SU-2026:2619-1
SLES 12 SP5 libpng16 1.6.8-15.9.1 SUSE-SU-2025:4533-1
SLES for SAP 16.0 libpng16 1.6.44-160000.3.1 SUSE-SU-2026:20030-1
SLES for SAP 15 SP5 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLES for SAP 15 SP4 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLES for SAP 15 SP3 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLES 16.0 libpng16 1.6.44-160000.3.1 SUSE-SU-2026:20030-1
SLE Micro 6.2 libpng16 1.6.44-160000.3.1 SUSE-SU-2026:20073-1
SLE Micro 6.1 libpng16 1.6.43-slfo.1.1_2.1 SUSE-SU-2026:23514-1, SUSE-SU-2025:21220-1
SLE Micro 6.0 libpng16 1.6.43-2.1 SUSE-SU-2026:23063-1, SUSE-SU-2025:21217-1
SLE Micro 5.5 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLE Micro 5.4 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLE Micro 5.3 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLE Micro 5.2 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLE HPC 15 SP5 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLE HPC 15 SP4 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SLE HPC 15 SP3 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SUSE Manager Server LTS 4.3 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SUSE Manager Proxy LTS 4.3 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
SUSE Enterprise Storage 7.1 libpng16 1.6.34-150000.3.12.1 SUSE-SU-2025:4436-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libpng16 1.6.51-1.1 openSUSE-SU-2025:15781-1
openSUSE Leap 16.0 libpng16 1.6.44-160000.3.1 openSUSE-SU-2026:20017-1
openSUSE Leap 15.6 libpng16 1.6.40-150600.3.3.1 SUSE-SU-2025:4494-1
ReleasePackageFixed inAdvisory
Alpine v3.24 libpng 1.6.51-r0 —
Alpine v3.23 libpng 1.6.51-r0 —
Alpine v3.22 libpng 1.6.51-r0 —
Alpine v3.21 libpng 1.6.53-r0 —
Alpine v3.20 libpng 1.6.53-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 firefox 140.5.0-1.amzn2023.0.2 ALAS2023-2025-1305
Amazon Linux 2023 libpng +3 2:1.6.37-10.amzn2023.0.7 ALAS2023-2025-1306
Amazon Linux 2 libpng +2 2:1.5.13-8.amzn2.0.6 ALAS2-2025-3112
Amazon Linux 2 libpng12 +1 1.2.50-10.amzn2.0.3 ALAS2-2025-3113
Amazon Linux 2 thunderbird 140.4.0-1.amzn2.0.3 ALAS2-2025-3091

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 fltk +2 No fix yet —
Azure Linux 3 libpng 1.6.51-1 —
Azure Linux 2 (CBL-Mariner) fltk +1 No fix yet —
Azure Linux 2 (CBL-Mariner) libpng 1.6.51-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 libpng +1 2:1.6.40-8.el10_1.1 ELSA-2026-0237
Oracle Linux 9 libpng +1 2:1.6.37-12.el9_7.1 ELSA-2026-0238
Oracle Linux 8 java-1.8.0-openjdk +19 1:1.8.0.482.b08-1.0.1.el8 ELSA-2026-0932
Oracle Linux 8 java-17-openjdk +22 1:17.0.18.0.8-1.0.1.el9 ELSA-2026-0927
Oracle Linux 8 java-21-openjdk +22 1:21.0.10.0.7-1.0.1.el10 ELSA-2026-0928
Oracle Linux 8 libpng +1 2:1.6.34-9.el8_10 ELSA-2026-0241
Oracle Linux 8 mingw32-libpng +3 1.6.34-1.el8_10 ELSA-2026-0125
Oracle Linux 7 java-11-openjdk +8 1:11.0.31.0.1-1.0.1.el7_9 ELSA-2026-0847
Oracle Linux 7 libpng +2 2:1.5.13-8.0.1.el7 ELSA-2026-0251

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling libpng 1.6.51-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 50

References