CVE-2026-25646

EUVD-2026-7050
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 58.68%
Affected Products (NVD)
VendorProductVersion
libpnglibpng
𝑥
< 1.6.55
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
2:1.6.40-8.el10_1.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
2:1.6.40-8.el10_0.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
2:1.5.13-8.el7_9.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
0:1.2.50-10.el7_9.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:1.5.30-8.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:1.2.57-6.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:1.6.34-2.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
2:1.6.34-10.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support
0:1.5.30-7.el8_2.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support
0:1.2.57-5.el8_2.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support
2:1.6.34-8.el8_2.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
0:1.5.30-7.el8_4.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
0:1.2.57-5.el8_4.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
2:1.6.34-8.el8_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
0:1.5.30-7.el8_4.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
0:1.2.57-5.el8_4.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
2:1.6.34-8.el8_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
0:1.5.30-7.el8_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
0:1.2.57-5.el8_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
2:1.6.34-8.el8_6.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service
0:1.5.30-7.el8_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service
0:1.2.57-5.el8_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service
2:1.6.34-8.el8_6.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions
0:1.5.30-7.el8_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions
0:1.2.57-5.el8_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions
2:1.6.34-8.el8_6.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
0:1.5.30-7.el8_8.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
0:1.2.57-5.el8_8.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
2:1.6.34-8.el8_8.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
0:1.5.30-7.el8_8.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
0:1.2.57-5.el8_8.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
2:1.6.34-8.el8_8.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:1.5.30-14.el9_7.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
2:1.6.37-12.el9_7.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions
2:1.6.37-12.el9_0.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions
0:1.5.30-14.el9_0.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
2:1.6.37-12.el9_2.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0:1.5.30-14.el9_2.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support
2:1.6.37-12.el9_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support
0:1.5.30-14.el9_4.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
2:1.6.37-12.el9_6.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
0:1.5.30-14.el9_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.12
412.86.202604281506-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.13
413.92.202604080111-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.14
414.92.202605060243-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.15
415.92.202605060220-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.16
416.94.202604211449-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.17
417.94.202605112123-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.18
418.94.202603261158-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.19
4.19.9.6.202604080618-0 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1778244546 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1775680192 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1775680262 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1775749857 ≤
𝑥
< *
ADP
Red HatRed Hat Ceph Storage 8
1774002867 ≤
𝑥
< *
ADP
Red HatRed Hat Discovery 2
1773273070 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
1.6.56-1.hum1 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
libpng1.6
bookworm
1.6.39-2+deb12u5
fixed
bookworm (security)
1.6.39-2+deb12u5
fixed
bullseye
vulnerable
bullseye (security)
1.6.37-3+deb11u4
fixed
forky
1.6.58-1
fixed
sid
1.6.58-1
fixed
trixie
1.6.48-1+deb13u5
fixed
trixie (security)
1.6.48-1+deb13u5
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium-browser
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
firefox
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
libpng
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
Fixed 1.2.50-1ubuntu2.14.04.3+esm1
released
xenial
Fixed 1.2.54-1ubuntu1.1+esm2
released
libpng1.6
bionic
Fixed 1.6.34-1ubuntu0.18.04.2+esm2
released
focal
Fixed 1.6.37-2ubuntu0.1~esm2
released
jammy
Fixed 1.6.37-3ubuntu0.4
released
noble
Fixed 1.6.43-5ubuntu0.5
released
questing
Fixed 1.6.50-1ubuntu0.4
released
resolute
Fixed 1.6.55-1
released
xenial
Fixed 1.6.20-2ubuntu0.1~esm3
released
thunderbird
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpng12-0
suse enterprise desktop 15 SP7
1.2.57-150000.4.6.1
fixed
suse enterprise sap 15 SP4
1.2.57-150000.4.6.1
fixed
suse enterprise sap 15 SP5
1.2.57-150000.4.6.1
fixed
suse enterprise sap 15 SP7
1.2.57-150000.4.6.1
fixed
suse enterprise server 12 SP3
1.2.59-20.17.1
fixed
suse enterprise server 12 SP5
1.2.59-20.17.1
fixed
suse enterprise server 15 SP4
1.2.57-150000.4.6.1
fixed
suse enterprise server 15 SP5
1.2.57-150000.4.6.1
fixed
suse enterprise server 15 SP6
1.2.57-150000.4.6.1
fixed
suse enterprise server 15 SP7
1.2.57-150000.4.6.1
fixed
libpng12-0-32bit
suse enterprise server 12 SP3
1.2.59-20.17.1
fixed
suse enterprise server 12 SP5
1.2.59-20.17.1
fixed
libpng12-compat-devel
suse enterprise server 12 SP5
1.2.59-20.17.1
fixed
libpng12-devel
suse enterprise desktop 15 SP7
1.2.57-150000.4.6.1
fixed
suse enterprise sap 15 SP4
1.2.57-150000.4.6.1
fixed
suse enterprise sap 15 SP5
1.2.57-150000.4.6.1
fixed
suse enterprise sap 15 SP7
1.2.57-150000.4.6.1
fixed
suse enterprise server 12 SP5
1.2.59-20.17.1
fixed
suse enterprise server 15 SP4
1.2.57-150000.4.6.1
fixed
suse enterprise server 15 SP5
1.2.57-150000.4.6.1
fixed
suse enterprise server 15 SP6
1.2.57-150000.4.6.1
fixed
suse enterprise server 15 SP7
1.2.57-150000.4.6.1
fixed
libpng15-15
suse enterprise server 12 SP3
1.5.30-10.16.1
fixed
suse enterprise server 12 SP5
1.5.30-10.16.1
fixed
libpng16-16
suse enterprise desktop 15 SP7
1.6.40-150600.3.12.1
fixed
suse enterprise sap 15 SP4
1.6.34-150000.3.19.1
fixed
suse enterprise sap 15 SP5
1.6.34-150000.3.19.1
fixed
suse enterprise sap 15 SP7
1.6.40-150600.3.12.1
fixed
suse enterprise server 12 SP3
1.6.8-15.18.1
fixed
suse enterprise server 12 SP5
1.6.8-15.18.1
fixed
suse enterprise server 15 SP4
1.6.34-150000.3.19.1
fixed
suse enterprise server 15 SP5
1.6.34-150000.3.19.1
fixed
suse enterprise server 15 SP6
1.6.40-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.6.40-150600.3.12.1
fixed
libpng16-16-32bit
suse enterprise desktop 15 SP7
1.6.40-150600.3.12.1
fixed
suse enterprise sap 15 SP4
1.6.34-150000.3.19.1
fixed
suse enterprise sap 15 SP5
1.6.34-150000.3.19.1
fixed
suse enterprise sap 15 SP7
1.6.40-150600.3.12.1
fixed
suse enterprise server 12 SP3
1.6.8-15.18.1
fixed
suse enterprise server 12 SP5
1.6.8-15.18.1
fixed
suse enterprise server 15 SP4
1.6.34-150000.3.19.1
fixed
suse enterprise server 15 SP5
1.6.34-150000.3.19.1
fixed
suse enterprise server 15 SP6
1.6.40-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.6.40-150600.3.12.1
fixed
libpng16-compat-devel
suse enterprise desktop 15 SP7
1.6.40-150600.3.12.1
fixed
suse enterprise sap 15 SP4
1.6.34-150000.3.19.1
fixed
suse enterprise sap 15 SP5
1.6.34-150000.3.19.1
fixed
suse enterprise sap 15 SP7
1.6.40-150600.3.12.1
fixed
suse enterprise server 12 SP5
1.6.8-15.18.1
fixed
suse enterprise server 15 SP4
1.6.34-150000.3.19.1
fixed
suse enterprise server 15 SP5
1.6.34-150000.3.19.1
fixed
suse enterprise server 15 SP6
1.6.40-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.6.40-150600.3.12.1
fixed
libpng16-devel
suse enterprise desktop 15 SP7
1.6.40-150600.3.12.1
fixed
suse enterprise sap 15 SP4
1.6.34-150000.3.19.1
fixed
suse enterprise sap 15 SP5
1.6.34-150000.3.19.1
fixed
suse enterprise sap 15 SP7
1.6.40-150600.3.12.1
fixed
suse enterprise server 12 SP5
1.6.8-15.18.1
fixed
suse enterprise server 15 SP4
1.6.34-150000.3.19.1
fixed
suse enterprise server 15 SP5
1.6.34-150000.3.19.1
fixed
suse enterprise server 15 SP6
1.6.40-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.6.40-150600.3.12.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libpng
RHEL 8
2:1.6.34-10.el8_10
fixed
RHEL 8.2 AUS
2:1.6.34-8.el8_2.2
fixed
RHEL 8.4 AUS
2:1.6.34-8.el8_4.2
fixed
RHEL 8.6 AUS
2:1.6.34-8.el8_6.2
fixed
RHEL 8.6 E4S
2:1.6.34-8.el8_6.2
fixed
RHEL 8.6 TUS
2:1.6.34-8.el8_6.2
fixed
RHEL 8.8 E4S
2:1.6.34-8.el8_8.2
fixed
RHEL 8.8 TUS
2:1.6.34-8.el8_8.2
fixed
RHEL 9
2:1.6.37-12.el9_7.2
fixed
libpng-devel
RHEL 8
2:1.6.34-10.el8_10
fixed
RHEL 8.2 AUS
2:1.6.34-8.el8_2.2
fixed
RHEL 8.4 AUS
2:1.6.34-8.el8_4.2
fixed
RHEL 8.6 AUS
2:1.6.34-8.el8_6.2
fixed
RHEL 8.6 E4S
2:1.6.34-8.el8_6.2
fixed
RHEL 8.6 TUS
2:1.6.34-8.el8_6.2
fixed
RHEL 8.8 E4S
2:1.6.34-8.el8_8.2
fixed
RHEL 8.8 TUS
2:1.6.34-8.el8_8.2
fixed
RHEL 9
2:1.6.37-12.el9_7.2
fixed
libpng15
RHEL 9
0:1.5.30-14.el9_7.1
fixed
mingw32-libpng
RHEL 8
0:1.6.34-2.el8_10
fixed
mingw32-libpng-static
RHEL 8
0:1.6.34-2.el8_10
fixed
mingw64-libpng
RHEL 8
0:1.6.34-2.el8_10
fixed
mingw64-libpng-static
RHEL 8
0:1.6.34-2.el8_10
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
libpng
Amazon Linux 2
2:1.5.13-8.amzn2.0.7
fixed
Amazon Linux 2023
2:1.6.37-10.amzn2023.0.11
fixed
libpng-debuginfo
Amazon Linux 2
2:1.5.13-8.amzn2.0.7
fixed
Amazon Linux 2023
2:1.6.37-10.amzn2023.0.11
fixed
libpng-debugsource
Amazon Linux 2023
2:1.6.37-10.amzn2023.0.11
fixed
libpng-devel
Amazon Linux 2
2:1.5.13-8.amzn2.0.7
fixed
Amazon Linux 2023
2:1.6.37-10.amzn2023.0.11
fixed
libpng-devel-debuginfo
Amazon Linux 2023
2:1.6.37-10.amzn2023.0.11
fixed
libpng-static
Amazon Linux 2
2:1.5.13-8.amzn2.0.7
fixed
Amazon Linux 2023
2:1.6.37-10.amzn2023.0.11
fixed
libpng-tools
Amazon Linux 2023
2:1.6.37-10.amzn2023.0.11
fixed
libpng-tools-debuginfo
Amazon Linux 2023
2:1.6.37-10.amzn2023.0.11
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
libpng
Azure Linux 3.0
0:1.6.55-1.azl3
fixed
CBL-Mariner 2.0
0:1.6.55-1.cm2
fixed
Common Weakness Enumeration
References
https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88
https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3
http://www.openwall.com/lists/oss-security/2026/02/09/7
https://access.redhat.com/errata/RHSA-2026:10097
https://access.redhat.com/errata/RHSA-2026:12274
https://access.redhat.com/errata/RHSA-2026:14773
https://access.redhat.com/errata/RHSA-2026:15087
https://access.redhat.com/errata/RHSA-2026:16174
https://access.redhat.com/errata/RHSA-2026:17596
https://access.redhat.com/errata/RHSA-2026:3031
https://access.redhat.com/errata/RHSA-2026:3405
https://access.redhat.com/errata/RHSA-2026:3551
https://access.redhat.com/errata/RHSA-2026:3573
https://access.redhat.com/errata/RHSA-2026:3574
https://access.redhat.com/errata/RHSA-2026:3575
https://access.redhat.com/errata/RHSA-2026:3576
https://access.redhat.com/errata/RHSA-2026:3577
https://access.redhat.com/errata/RHSA-2026:3968
https://access.redhat.com/errata/RHSA-2026:3969
https://access.redhat.com/errata/RHSA-2026:4221
https://access.redhat.com/errata/RHSA-2026:4222
https://access.redhat.com/errata/RHSA-2026:4306
https://access.redhat.com/errata/RHSA-2026:4501
https://access.redhat.com/errata/RHSA-2026:4728
https://access.redhat.com/errata/RHSA-2026:4729
https://access.redhat.com/errata/RHSA-2026:4730
https://access.redhat.com/errata/RHSA-2026:4731
https://access.redhat.com/errata/RHSA-2026:4732
https://access.redhat.com/errata/RHSA-2026:4756
https://access.redhat.com/errata/RHSA-2026:5606
https://access.redhat.com/errata/RHSA-2026:6439
https://access.redhat.com/errata/RHSA-2026:6445
https://access.redhat.com/errata/RHSA-2026:6466
https://access.redhat.com/errata/RHSA-2026:6467
https://access.redhat.com/errata/RHSA-2026:6468
https://access.redhat.com/errata/RHSA-2026:6469
https://access.redhat.com/errata/RHSA-2026:6553
https://access.redhat.com/errata/RHSA-2026:6732
https://access.redhat.com/errata/RHSA-2026:7032
https://access.redhat.com/errata/RHSA-2026:7033
https://access.redhat.com/errata/RHSA-2026:7034
https://access.redhat.com/errata/RHSA-2026:7035
https://access.redhat.com/errata/RHSA-2026:7036
https://access.redhat.com/errata/RHSA-2026:7239
https://access.redhat.com/errata/RHSA-2026:7243
https://access.redhat.com/errata/RHSA-2026:8746
https://access.redhat.com/errata/RHSA-2026:8747
https://access.redhat.com/errata/RHSA-2026:8748
https://access.redhat.com/security/cve/CVE-2026-25646
https://bugzilla.redhat.com/show_bug.cgi?id=2438542
https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25646.json