CVE-2025-65018

EUVD-2025-199236

25.11.2025, 00:15

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
GitHub_M	CNA	7.1 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 20%

Affected Products (NVD)

Vendor	Product	Version
libpng	libpng	1.6.0 ≤ 𝑥 < 1.6.51

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libpng1.6

bookworm	1.6.39-2+deb12u1 fixed
bookworm (security)	1.6.39-2+deb12u3 fixed
bullseye	vulnerable
bullseye (security)	1.6.37-3+deb11u2 fixed
forky	1.6.55-1 fixed
sid	1.6.55-1 fixed
trixie	1.6.48-1+deb13u1 fixed
trixie (security)	1.6.48-1+deb13u3 fixed

Ubuntu Releases

Ubuntu Product

Codename

libpng

jammy	dne
noble	dne
plucky	dne
questing	dne
trusty	not-affected
xenial	not-affected

firefox

jammy	not-affected
noble	not-affected
plucky	not-affected
questing	not-affected

thunderbird

jammy	not-affected
noble	not-affected
plucky	ignored
questing	not-affected

chromium-browser

jammy	not-affected
noble	not-affected
plucky	not-affected
questing	not-affected

libpng1.6

bionic	Fixed 1.6.34-1ubuntu0.18.04.2+esm1 released
focal	Fixed 1.6.37-2ubuntu0.1~esm1 released
jammy	Fixed 1.6.37-3ubuntu0.1 released
noble	Fixed 1.6.43-5ubuntu0.1 released
plucky	Fixed 1.6.47-1.1ubuntu0.1 released
questing	Fixed 1.6.50-1ubuntu0.1 released
xenial	Fixed 1.6.20-2ubuntu0.1~esm2 released

Known Exploits!

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d

https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea

https://github.com/pnggroup/libpng/issues/755

https://github.com/pnggroup/libpng/pull/757

https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g

https://github.com/pnggroup/libpng/issues/755

https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g