CVE-2026-22695

EUVD-2026-2420

12.01.2026, 23:15

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.1 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 7.06%

Affected Products (NVD)

Vendor	Product	Version
libpng	libpng	1.6.51 ≤ 𝑥 < 1.6.54

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libpng1.6

bookworm	1.6.39-2+deb12u5 fixed
bookworm (security)	1.6.39-2+deb12u5 fixed
bullseye	vulnerable
bullseye (security)	1.6.37-3+deb11u4 fixed
forky	1.6.58-1 fixed
sid	1.6.58-1 fixed
trixie	1.6.48-1+deb13u5 fixed
trixie (security)	1.6.48-1+deb13u5 fixed

Ubuntu Releases

Ubuntu Product

Codename

chromium-browser

jammy	not-affected
noble	not-affected
plucky	not-affected
questing	not-affected

firefox

jammy	not-affected
noble	not-affected
plucky	not-affected
questing	not-affected

libpng

jammy	dne
noble	dne
plucky	dne
questing	dne
trusty	not-affected
xenial	not-affected

libpng1.6

bionic	Fixed 1.6.34-1ubuntu0.18.04.2+esm2 released
focal	Fixed 1.6.37-2ubuntu0.1~esm2 released
jammy	Fixed 1.6.37-3ubuntu0.3 released
noble	Fixed 1.6.43-5ubuntu0.3 released
plucky	Fixed 1.6.47-1.1ubuntu0.3 released
questing	Fixed 1.6.50-1ubuntu0.3 released
xenial	Fixed 1.6.20-2ubuntu0.1~esm3 released

thunderbird

jammy	not-affected
noble	not-affected
plucky	ignored
questing	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

libpng16-16

suse enterprise desktop 15 SP7	1.6.40-150600.3.6.1 fixed
suse enterprise sap 15 SP4	1.6.34-150000.3.19.1 fixed
suse enterprise sap 15 SP5	1.6.34-150000.3.19.1 fixed
suse enterprise sap 15 SP7	1.6.40-150600.3.6.1 fixed
suse enterprise server 12 SP3	1.6.8-15.15.1 fixed
suse enterprise server 15 SP4	1.6.34-150000.3.19.1 fixed
suse enterprise server 15 SP5	1.6.34-150000.3.19.1 fixed
suse enterprise server 15 SP7	1.6.40-150600.3.6.1 fixed

libpng16-16-32bit

suse enterprise desktop 15 SP7	1.6.40-150600.3.6.1 fixed
suse enterprise sap 15 SP4	1.6.34-150000.3.19.1 fixed
suse enterprise sap 15 SP5	1.6.34-150000.3.19.1 fixed
suse enterprise sap 15 SP7	1.6.40-150600.3.6.1 fixed
suse enterprise server 12 SP3	1.6.8-15.15.1 fixed
suse enterprise server 15 SP4	1.6.34-150000.3.19.1 fixed
suse enterprise server 15 SP5	1.6.34-150000.3.19.1 fixed
suse enterprise server 15 SP7	1.6.40-150600.3.6.1 fixed

libpng16-compat-devel

suse enterprise desktop 15 SP7	1.6.40-150600.3.6.1 fixed
suse enterprise sap 15 SP4	1.6.34-150000.3.19.1 fixed
suse enterprise sap 15 SP5	1.6.34-150000.3.19.1 fixed
suse enterprise sap 15 SP7	1.6.40-150600.3.6.1 fixed
suse enterprise server 15 SP4	1.6.34-150000.3.19.1 fixed
suse enterprise server 15 SP5	1.6.34-150000.3.19.1 fixed
suse enterprise server 15 SP7	1.6.40-150600.3.6.1 fixed

libpng16-devel

suse enterprise desktop 15 SP7	1.6.40-150600.3.6.1 fixed
suse enterprise sap 15 SP4	1.6.34-150000.3.19.1 fixed
suse enterprise sap 15 SP5	1.6.34-150000.3.19.1 fixed
suse enterprise sap 15 SP7	1.6.40-150600.3.6.1 fixed
suse enterprise server 15 SP4	1.6.34-150000.3.19.1 fixed
suse enterprise server 15 SP5	1.6.34-150000.3.19.1 fixed
suse enterprise server 15 SP7	1.6.40-150600.3.6.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

java-1.8.0-openjdk

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-accessibility

RHEL 8

1:1.8.0.492.b09-1.el8

fixed

java-1.8.0-openjdk-accessibility-fastdebug

RHEL 8

1:1.8.0.492.b09-1.el8

fixed

java-1.8.0-openjdk-accessibility-slowdebug

RHEL 8

1:1.8.0.492.b09-1.el8

fixed

java-1.8.0-openjdk-demo

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-demo-fastdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-demo-slowdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-devel

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-devel-fastdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-devel-slowdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-fastdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-headless

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-headless-fastdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-headless-slowdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-javadoc

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-javadoc-zip

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-slowdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-src

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-src-fastdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-1.8.0-openjdk-src-slowdebug

RHEL 8	1:1.8.0.492.b09-1.el8 fixed
RHEL 9	1:1.8.0.492.b09-2.el9 fixed

java-17-openjdk

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-demo

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-demo-fastdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-demo-slowdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-devel

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-devel-fastdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-devel-slowdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-fastdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-headless

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-headless-fastdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-headless-slowdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-javadoc

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-javadoc-zip

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-jmods

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-jmods-fastdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-jmods-slowdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-slowdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-src

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-src-fastdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-src-slowdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-static-libs

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-static-libs-fastdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-17-openjdk-static-libs-slowdebug

RHEL 8	1:17.0.19.0.10-1.el8 fixed
RHEL 9	1:17.0.19.0.10-2.el9 fixed

java-21-openjdk

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-demo

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-demo-fastdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-demo-slowdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-devel

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-devel-fastdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-devel-slowdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-fastdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-headless

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-headless-fastdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-headless-slowdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-javadoc

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-javadoc-zip

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-jmods

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-jmods-fastdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-jmods-slowdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-slowdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-src

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-src-fastdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-src-slowdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-static-libs

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-static-libs-fastdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

java-21-openjdk-static-libs-slowdebug

RHEL 8	1:21.0.11.0.10-1.el8 fixed
RHEL 9	1:21.0.11.0.10-2.el9 fixed

libpng

RHEL 8	2:1.6.34-10.el8_10 fixed
RHEL 8.2 AUS	2:1.6.34-8.el8_2.2 fixed
RHEL 8.4 AUS	2:1.6.34-8.el8_4.2 fixed
RHEL 8.6 AUS	2:1.6.34-8.el8_6.2 fixed
RHEL 8.6 E4S	2:1.6.34-8.el8_6.2 fixed
RHEL 8.6 TUS	2:1.6.34-8.el8_6.2 fixed
RHEL 8.8 E4S	2:1.6.34-8.el8_8.2 fixed
RHEL 8.8 TUS	2:1.6.34-8.el8_8.2 fixed
RHEL 9	2:1.6.37-12.el9_7.2 fixed

libpng-devel

RHEL 8	2:1.6.34-10.el8_10 fixed
RHEL 8.2 AUS	2:1.6.34-8.el8_2.2 fixed
RHEL 8.4 AUS	2:1.6.34-8.el8_4.2 fixed
RHEL 8.6 AUS	2:1.6.34-8.el8_6.2 fixed
RHEL 8.6 E4S	2:1.6.34-8.el8_6.2 fixed
RHEL 8.6 TUS	2:1.6.34-8.el8_6.2 fixed
RHEL 8.8 E4S	2:1.6.34-8.el8_8.2 fixed
RHEL 8.8 TUS	2:1.6.34-8.el8_8.2 fixed
RHEL 9	2:1.6.37-12.el9_7.2 fixed

mingw32-libpng

RHEL 8

0:1.6.34-2.el8_10

fixed

mingw32-libpng-static

RHEL 8

0:1.6.34-2.el8_10

fixed

mingw64-libpng

RHEL 8

0:1.6.34-2.el8_10

fixed

mingw64-libpng-static

RHEL 8

0:1.6.34-2.el8_10

fixed

Amazon Linux Releases

Amazon Package

Release

firefox

Amazon Linux 2023

0:140.7.0-1.amzn2023.0.3

fixed

firefox-debuginfo

Amazon Linux 2023

0:140.7.0-1.amzn2023.0.3

fixed

firefox-debugsource

Amazon Linux 2023

0:140.7.0-1.amzn2023.0.3

fixed

libpng

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.9

fixed

libpng-debuginfo

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.9

fixed

libpng-debugsource

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.9

fixed

libpng-devel

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.9

fixed

libpng-devel-debuginfo

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.9

fixed

libpng-static

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.9

fixed

libpng-tools

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.9

fixed

libpng-tools-debuginfo

Amazon Linux 2023

2:1.6.37-10.amzn2023.0.9

fixed

thunderbird

Amazon Linux 2

0:140.7.1-1.amzn2.0.2

fixed

Azure Linux Releases

Azure Package

Release

libpng

Azure Linux 3.0	0:1.6.54-1.azl3 fixed
CBL-Mariner 2.0	0:1.6.54-1.cm2 fixed

Known Exploits!

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

References

https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea

https://github.com/pnggroup/libpng/commit/e4f7ad4ea2

https://github.com/pnggroup/libpng/issues/778

https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp