CVE-2025-65018: Critical Remote Code Execution Vulnerability in libpng
Summary
CVE-2025-65018: In multiple locations, there is a possible way to achieve remote code execution due to a heap buffer overflow. Affects platform/external/libpng across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpng is a widely used open-source library for handling PNG (Portable Network Graphics) image files. It provides essential functionality for reading and writing PNG images, making it a critical component in various applications and systems that require image processing. The library is known for its efficiency and flexibility, but like any software, it can be susceptible to vulnerabilities that may compromise the security of applications that rely on it.
Vulnerability Detail
The vulnerability identified as CVE-2025-65018 is a critical remote code execution flaw caused by a heap buffer overflow in multiple locations within the libpng library. This issue allows attackers to exploit the vulnerability without requiring user interaction, leading to potential remote escalation of privileges. The flaw can be triggered by specially crafted PNG files, which may allow an attacker to execute arbitrary code on the affected system, posing significant risks to data integrity and system security.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize PNG files before processing them. This can help mitigate the risk of exploitation by rejecting malformed or suspicious files.
Conclusion
The CVE-2025-65018 vulnerability in the libpng library poses a critical risk due to its potential for remote code execution. It is crucial for developers and organizations to update their libpng versions to the patched releases to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform/external/libpng →
FAQ
CVE-2025-65018 is a critical vulnerability in the libpng library that allows remote code execution due to a heap buffer overflow.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your gradle.lockfile for vulnerabilities without requiring signup.
The vulnerability can lead to remote code execution, allowing attackers to gain unauthorized access and control over affected systems.
No, user interaction is not needed for exploitation, making it particularly dangerous.
Implement input validation to sanitize PNG files before processing them as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/libpng.
