CVE-2026-22695 LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)

What is CVE-2026-22695?

CVE-2026-22695 is a medium-severity memory corruption vulnerability in Libpng Libpng, published on 12 Jan 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.

Weakness: CWE-125

Which versions are affected by CVE-2026-22695?

It affects 1 product.

Products include Libpng Libpng.

How do I fix CVE-2026-22695?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-22695 being exploited?

There is no known exploitation of CVE-2026-22695 in the wild and no public exploit code.

Other vulnerabilities in Libpng Libpng

• CVE-2017-12652 Denial of service in n/a Critical 9.8
• CVE-2018-14550 Out-of-bounds write in libpng High 8.8
• CVE-2026-25646 LIBPNG has a heap buffer overflow in png_set_quantize High 8.3
• CVE-2026-33636 LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 High 7.6
• CVE-2026-33416 LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` High 7.5

All Libpng Libpng vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-22695, AZL-74267, AZL-74280, BELL-CVE-2026-22695, CLEANSTART-2026-ZH25873, DEBIAN-CVE-2026-22695 and 7 more.