CVE-2026-22801 LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*
An integer truncation in libpng's simplified write API allows heap buffer over-reads when processing images with specific negative or large row strides.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22801?
CVE-2026-22801 is a medium-severity vulnerability in Libpng Libpng, published on 12 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.
Which versions are affected by CVE-2026-22801?
It affects 1 product.
Products include Libpng Libpng.
How do I fix CVE-2026-22801?
Upgrade to a fixed version.
Is CVE-2026-22801 being exploited?
There is no known exploitation of CVE-2026-22801 in the wild and no public exploit code.
Other vulnerabilities in Libpng Libpng
- CVE-2017-12652 Denial of service in n/a
- CVE-2018-14550 Out-of-bounds write in libpng
- CVE-2026-25646 LIBPNG has a heap buffer overflow in png_set_quantize
- CVE-2026-33636 LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64
- CVE-2026-33416 LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`
Sources
Also known as ALPINE-CVE-2026-22801, AZL-74264, AZL-74283, AZL-74499, AZL-74502, AZL-74505 and 12 more.