CVE-2025-64505 LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index
An attacker can cause a heap buffer over-read in libpng by providing a malformed PNG file with invalid palette indices, potentially leading to crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-64505?
CVE-2025-64505 is a medium-severity memory corruption vulnerability in Libpng Libpng, published on 24 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.
Weakness: CWE-125
Which versions are affected by CVE-2025-64505?
It affects 1 product.
Linux distribution packages (6)
libpng12 SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 1.2.57-150000.4.3.1 |
libpng12 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.2.57-150000.4.3.1 |
libpng12 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.2.50-20.6.1 |
libpng15 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.5.22-10.7.1 |
libpng12 openSUSE:Leap 15.6 | All versions | 1.2.57-150000.4.3.1 |
libpng12 openSUSE:Tumbleweed | All versions | 1.2.59-4.1 |
Products include Libpng Libpng.
How do I fix CVE-2025-64505?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-64505 being exploited?
There is no known exploitation of CVE-2025-64505 in the wild and no public exploit code.
Other vulnerabilities in Libpng Libpng
- CVE-2017-12652 Denial of service in n/a
- CVE-2018-14550 Out-of-bounds write in libpng
- CVE-2026-25646 LIBPNG has a heap buffer overflow in png_set_quantize
- CVE-2026-33636 LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64
- CVE-2026-33416 LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`
Sources
Also known as A-463980379, ALPINE-CVE-2025-64505, ASB-A-463980379, AZL-70763, AZL-70844, AZL-70859 and 24 more.