CVE-2025-66293

EUVD-2025-201132

03.12.2025, 21:15

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 28.3%

Affected Products (NVD)

Vendor	Product	Version
libpng	libpng	𝑥 < 1.6.52

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libpng1.6

bookworm	1.6.39-2+deb12u5 fixed
bookworm (security)	1.6.39-2+deb12u5 fixed
bullseye	vulnerable
bullseye (security)	1.6.37-3+deb11u4 fixed
forky	1.6.58-1 fixed
sid	1.6.58-1 fixed
trixie	1.6.48-1+deb13u5 fixed
trixie (security)	1.6.48-1+deb13u5 fixed

Ubuntu Releases

Ubuntu Product

Codename

chromium-browser

jammy	not-affected
noble	not-affected
plucky	not-affected
questing	not-affected
resolute	not-affected

firefox

jammy	not-affected
noble	not-affected
plucky	not-affected
questing	not-affected
resolute	not-affected

libpng

jammy	dne
noble	dne
plucky	dne
questing	dne
resolute	dne
trusty	not-affected
xenial	not-affected

libpng1.6

bionic	Fixed 1.6.34-1ubuntu0.18.04.2+esm2 released
focal	Fixed 1.6.37-2ubuntu0.1~esm2 released
jammy	Fixed 1.6.37-3ubuntu0.3 released
noble	Fixed 1.6.43-5ubuntu0.3 released
plucky	Fixed 1.6.47-1.1ubuntu0.3 released
questing	Fixed 1.6.50-1ubuntu0.3 released
resolute	not-affected
xenial	Fixed 1.6.20-2ubuntu0.1~esm3 released

thunderbird

jammy	not-affected
noble	not-affected
plucky	ignored
questing	not-affected
resolute	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

libpng16-16

suse enterprise desktop 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	1.6.40-150600.3.3.1 fixed
suse enterprise sap 12 SP5	1.6.8-15.12.1 fixed
suse enterprise sap 15 SP3	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP4	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP5	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise sap 15 SP7	1.6.40-150600.3.3.1 fixed
suse enterprise server 12 SP3	1.6.8-15.12.1 fixed
suse enterprise server 12 SP5	1.6.8-15.12.1 fixed
suse enterprise server 15 SP2	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP3	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP4	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP5	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise server 15 SP7	1.6.40-150600.3.3.1 fixed

libpng16-16-32bit

suse enterprise desktop 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	1.6.40-150600.3.3.1 fixed
suse enterprise sap 12 SP5	1.6.8-15.12.1 fixed
suse enterprise sap 15 SP3	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP4	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP5	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise sap 15 SP7	1.6.40-150600.3.3.1 fixed
suse enterprise server 12 SP3	1.6.8-15.12.1 fixed
suse enterprise server 12 SP5	1.6.8-15.12.1 fixed
suse enterprise server 15 SP2	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP3	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP4	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP5	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise server 15 SP7	1.6.40-150600.3.3.1 fixed

libpng16-compat-devel

suse enterprise desktop 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	1.6.40-150600.3.3.1 fixed
suse enterprise sap 12 SP5	1.6.8-15.12.1 fixed
suse enterprise sap 15 SP3	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP4	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP5	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise sap 15 SP7	1.6.40-150600.3.3.1 fixed
suse enterprise server 12 SP5	1.6.8-15.12.1 fixed
suse enterprise server 15 SP2	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP3	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP4	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP5	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise server 15 SP7	1.6.40-150600.3.3.1 fixed

libpng16-devel

suse enterprise desktop 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise desktop 15 SP7	1.6.40-150600.3.3.1 fixed
suse enterprise sap 12 SP5	1.6.8-15.12.1 fixed
suse enterprise sap 15 SP3	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP4	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP5	1.6.34-150000.3.12.1 fixed
suse enterprise sap 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise sap 15 SP7	1.6.40-150600.3.3.1 fixed
suse enterprise server 12 SP5	1.6.8-15.12.1 fixed
suse enterprise server 15 SP2	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP3	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP4	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP5	1.6.34-150000.3.12.1 fixed
suse enterprise server 15 SP6	1.6.40-150600.3.3.1 fixed
suse enterprise server 15 SP7	1.6.40-150600.3.3.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

libpng

RHEL 8	2:1.6.34-9.el8_10 fixed
RHEL 8.2 AUS	2:1.6.34-8.el8_2.1 fixed
RHEL 8.4 AUS	2:1.6.34-8.el8_4.1 fixed
RHEL 8.6 AUS	2:1.6.34-8.el8_6.1 fixed
RHEL 8.6 E4S	2:1.6.34-8.el8_6.1 fixed
RHEL 8.6 TUS	2:1.6.34-8.el8_6.1 fixed
RHEL 8.8 E4S	2:1.6.34-8.el8_8.1 fixed
RHEL 8.8 TUS	2:1.6.34-8.el8_8.1 fixed
RHEL 9	2:1.6.37-12.el9_7.1 fixed

libpng-devel

RHEL 8	2:1.6.34-9.el8_10 fixed
RHEL 8.2 AUS	2:1.6.34-8.el8_2.1 fixed
RHEL 8.4 AUS	2:1.6.34-8.el8_4.1 fixed
RHEL 8.6 AUS	2:1.6.34-8.el8_6.1 fixed
RHEL 8.6 E4S	2:1.6.34-8.el8_6.1 fixed
RHEL 8.6 TUS	2:1.6.34-8.el8_6.1 fixed
RHEL 8.8 E4S	2:1.6.34-8.el8_8.1 fixed
RHEL 8.8 TUS	2:1.6.34-8.el8_8.1 fixed
RHEL 9	2:1.6.37-12.el9_7.1 fixed

mingw32-libpng

RHEL 8

0:1.6.34-1.el8_10

fixed

mingw32-libpng-static

RHEL 8

0:1.6.34-1.el8_10

fixed

mingw64-libpng

RHEL 8

0:1.6.34-1.el8_10

fixed

mingw64-libpng-static

RHEL 8

0:1.6.34-1.el8_10

fixed

Amazon Linux Releases

Amazon Package

Release

firefox

Amazon Linux 2023

0:140.6.0-1.amzn2023.0.1

fixed

firefox-debuginfo

Amazon Linux 2023

0:140.6.0-1.amzn2023.0.1

fixed

firefox-debugsource

Amazon Linux 2023

0:140.6.0-1.amzn2023.0.1

fixed

libpng

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.8

fixed

libpng-debuginfo

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.8

fixed

libpng-debugsource

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.8

fixed

libpng-devel

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.8

fixed

libpng-devel-debuginfo

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.8

fixed

libpng-static

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.8

fixed

libpng-tools

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.8

fixed

libpng-tools-debuginfo

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.8

fixed

thunderbird

Amazon Linux 2

0:140.6.0-1.amzn2.0.1

fixed

Azure Linux Releases

Azure Package

Release

libpng

Azure Linux 3.0

0:1.6.52-1.azl3

fixed

qt5-qtbase

CBL-Mariner 2.0

0:5.12.11-19.cm2

fixed

Known Exploits!

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

References

https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1

https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a

https://github.com/pnggroup/libpng/issues/764

https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f

http://www.openwall.com/lists/oss-security/2025/12/03/6

http://www.openwall.com/lists/oss-security/2025/12/03/7

http://www.openwall.com/lists/oss-security/2025/12/03/8

https://github.com/pnggroup/libpng/issues/764