CVE-2025-64505: Critical Heap Buffer Overflow in libpng Leading to Denial of Service
Summary
CVE-2025-64505: In png_init_read_transformations of pngrtran.c, there is a possible way to cause a persistent denial of service due to a heap buffer overflow. Affects platform/external/libpng across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpng is a widely-used open-source library for handling PNG (Portable Network Graphics) image files. It provides functionalities for reading and writing PNG images, making it essential for applications that require image processing. The library is known for its efficiency and flexibility, but like any software, it can be vulnerable to security issues. The vulnerability in question arises from a heap buffer overflow in the png_init_read_transformations function, which can be exploited to cause a denial of service.
Vulnerability Detail
The vulnerability is a heap buffer overflow located in the png_init_read_transformations function of the pngrtran.c file. This flaw allows an attacker to manipulate the memory allocation process, potentially leading to a persistent denial of service. The exploitation of this vulnerability does not require any additional execution privileges or user interaction, making it particularly dangerous. If successfully exploited, it can crash the application using the library, leading to service interruptions.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize image data before processing. This can help mitigate the risk of exploitation until the library is updated. Additionally, monitor your application for unusual behavior that may indicate an attempted exploit.
Conclusion
The vulnerability CVE-2025-64505 in the libpng library poses a critical risk due to a heap buffer overflow that can lead to denial of service. It is crucial to update to the patched version as soon as possible to protect your applications. Utilize Vulert to monitor and check for vulnerabilities in your software.
See every vulnerability recorded for platform/external/libpng →
FAQ
CVE-2025-64505 is a critical vulnerability in the libpng library that allows for a heap buffer overflow, potentially leading to a denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
Exploitation of this vulnerability can lead to a persistent denial of service, causing applications that rely on libpng to crash.
No, user interaction is not required for exploitation, making it a significant risk for applications using the affected library.
If you cannot update immediately, implement input validation on image data and monitor your application for unusual behavior to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/libpng.
