Critical Security Flaw in libpng: Buffer Overflow and Out-of-Bounds Read Vulnerabilities
Summary
ALSA-2026:0237: Important: libpng security update. Affects libpng versions < 2:1.6.40-8.el10_1.1. Fixed in 2:1.6.40-8.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpng is a widely used library that provides functions for creating and manipulating Portable Network Graphics (PNG) image files. It is essential for applications that require image processing and rendering. The library is known for its efficiency and support for various PNG features. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities in libpng include a buffer overflow (CVE-2025-64720), a heap buffer overflow (CVE-2025-65018), and an out-of-bounds read in the png_image_read_composite function (CVE-2025-66293). These flaws can lead to arbitrary code execution, data corruption, or denial of service, posing significant risks to systems using affected versions of the library.
How To Fix
Minimum fixed version
2:1.6.40-8.el10_1.1
This is the first release that contains the fix.
sudo dnf update libpngTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functions in libpng until the update is applied. However, this may limit functionality depending on the application’s reliance on image processing features.
Conclusion
The identified vulnerabilities in libpng pose serious security risks that can affect applications relying on this library. It is imperative to update to the latest patched version to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for libpng →
FAQ
libpng is a library used for handling PNG image files, providing essential functions for image creation and manipulation.
The vulnerabilities can lead to arbitrary code execution, data corruption, or denial of service, which can compromise system integrity.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot update immediately, avoid using the affected functions in libpng as a temporary workaround.
More details can be found on the CVE pages linked in the advisory, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for libpng.
