Critical Security Update for mingw-libpng: Buffer Overflows and Out-of-Bounds Read
Summary
ALSA-2026:0125: Important: mingw-libpng security update. Affects mingw32-libpng versions < 1.6.34-1.el8_10. Fixed in 1.6.34-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mingw-libpng package is a MinGW Windows implementation of the popular libpng library, which is used for handling PNG (Portable Network Graphics) image files. It provides essential functionality for reading and writing PNG images, making it a crucial component for applications that require image processing. However, vulnerabilities in this library can lead to severe security risks, including buffer overflows and out-of-bounds reads, which can be exploited by attackers to execute arbitrary code or cause application crashes.
Vulnerability Detail
The mingw-libpng package has been identified with several critical vulnerabilities, including a buffer overflow (CVE-2025-64720), a heap buffer overflow (CVE-2025-65018), and an out-of-bounds read in the png_image_read_composite function (CVE-2025-66293). These vulnerabilities arise from improper handling of PNG image data, which can allow attackers to manipulate image files in a way that leads to memory corruption. The ramifications of these vulnerabilities can be severe, potentially allowing attackers to execute arbitrary code or crash applications that rely on the affected library.
How To Fix
Minimum fixed version
1.6.34-1.el8_10
This is the first release that contains the fix.
sudo dnf update mingw32-libpngTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functions in the libpng library until the package is updated. Additionally, validating and sanitizing input PNG files before processing them can help mitigate the risk of exploitation.
Conclusion
The mingw-libpng package has critical vulnerabilities that pose significant security risks. It is essential for users to update to the patched version to protect their applications from potential exploitation. Regular monitoring and validation of dependencies can help maintain security in software development.
See every vulnerability recorded for mingw32-libpng →
FAQ
mingw-libpng is a MinGW Windows implementation of the libpng library, which is used for reading and writing PNG image files.
The vulnerabilities include a buffer overflow, a heap buffer overflow, and an out-of-bounds read, which can lead to memory corruption and potential code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Update the mingw-libpng package to version 1.6.34-1.el8_10 or later to fix the vulnerabilities. Additionally, consider implementing input validation for PNG files.
Failing to update the package leaves your application vulnerable to exploitation, which could lead to unauthorized access, data breaches, or application crashes.
Related vulnerabilities
Recent vulnerabilities recorded for mingw32-libpng.
