CVE-2025-65018

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.1 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
GitHub_MCNA
7.1 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
VendorProductVersion
libpnglibpng
1.6.0 ≤
𝑥
< 1.6.51
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libpng1.6
bullseye
vulnerable
bookworm
vulnerable
trixie
vulnerable
forky
1.6.51-1
fixed
sid
1.6.52-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libpng
questing
dne
plucky
dne
noble
dne
jammy
dne
xenial
needs-triage
trusty
needs-triage
libpng1.6
questing
needs-triage
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
firefox
questing
not-affected
plucky
not-affected
noble
not-affected
jammy
not-affected
thunderbird
questing
needs-triage
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
chromium-browser
questing
not-affected
plucky
not-affected
noble
not-affected
jammy
not-affected