Critical Security Update for libpng: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3405: Important: libpng security update. Affects libpng versions < 2:1.6.37-12.el9_7.2. Fixed in 2:1.6.37-12.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpng is a widely used library for creating and manipulating Portable Network Graphics (PNG) image files. It provides essential functions for image processing, making it a critical component in various applications that handle PNG formats. The library is known for its efficiency and versatility, but recent vulnerabilities have raised concerns about its security, particularly in how it handles image data.
Vulnerability Detail
The vulnerabilities in libpng stem from improper handling of image data, leading to potential information disclosure and denial of service. Specifically, there are issues related to integer truncation in the simplified write API (CVE-2026-22801), heap buffer over-read in png_image_finish_read (CVE-2026-22695), and a heap buffer overflow in png_set_quantize (CVE-2026-25646). These vulnerabilities could allow attackers to exploit the library, potentially leading to unauthorized access to sensitive information or application crashes.
How To Fix
Minimum fixed version
2:1.6.37-12.el9_7.2
This is the first release that contains the fix.
sudo dnf update libpngTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling features that utilize the affected APIs until the update can be applied. This may involve modifying your application code to avoid using the simplified write API and related functions until the library is updated.
Conclusion
The recent vulnerabilities in libpng highlight the importance of maintaining up-to-date libraries in software development. By promptly applying the necessary updates, developers can protect their applications from potential exploits and ensure the integrity of their image processing functionalities.
See every vulnerability recorded for libpng →
FAQ
libpng is a library that provides functions for creating and manipulating PNG image files, widely used in various software applications.
The vulnerabilities include integer truncation, heap buffer over-read, and heap buffer overflow, which can lead to information disclosure and denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, consider disabling features that use the affected APIs as a temporary workaround.
For more details, refer to the CVE pages linked in the advisory, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for libpng.
