CVE-2026-25646 LIBPNG has a heap buffer overflow in png_set_quantize
A heap buffer overflow in libpng allows attackers to cause denial of service or potentially execute code via crafted PNG images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25646?
CVE-2026-25646 is a high-severity memory corruption vulnerability in Libpng Libpng, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.
Which versions are affected by CVE-2026-25646?
1 open source package ship an affected version, including png. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
png CRAN | From 0.1-3 | 0.1-9 |
Linux distribution packages (39)
libpng12 AlmaLinux:8 | All versions | 1.2.57-6.el8_10 |
libpng15 AlmaLinux:8 | All versions | 1.5.30-8.el8_10 |
libpng15 AlmaLinux:9 | All versions | 1.5.30-14.el9_7.1 |
libpng12 Red Hat:enterprise_linux:8::appstream | All versions | 0:1.2.57-6.el8_10 |
libpng12-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.2.57-6.el8_10 |
libpng12-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.2.57-6.el8_10 |
libpng15 Red Hat:enterprise_linux:8::appstream | All versions | 0:1.5.30-8.el8_10 |
libpng15-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.5.30-8.el8_10 |
libpng15-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.5.30-8.el8_10 |
libpng15 Red Hat:enterprise_linux:9::appstream | All versions | 0:1.5.30-14.el9_7.1 |
libpng15-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.5.30-14.el9_7.1 |
libpng15-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.5.30-14.el9_7.1 |
libpng12 Red Hat:rhel_aus:8.2::appstream | All versions | 0:1.2.57-5.el8_2.1 |
libpng15 Red Hat:rhel_aus:8.2::appstream | All versions | 0:1.5.30-7.el8_2.1 |
libpng15-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 0:1.5.30-7.el8_2.1 |
libpng15-debugsource Red Hat:rhel_aus:8.2::appstream | All versions | 0:1.5.30-7.el8_2.1 |
libpng12 Red Hat:rhel_aus:8.4::appstream | All versions | 0:1.2.57-5.el8_4.1 |
libpng15 Red Hat:rhel_aus:8.4::appstream | All versions | 0:1.5.30-7.el8_4.1 |
libpng15-debuginfo Red Hat:rhel_aus:8.4::appstream | All versions | 0:1.5.30-7.el8_4.1 |
libpng15-debugsource Red Hat:rhel_aus:8.4::appstream | All versions | 0:1.5.30-7.el8_4.1 |
libpng12 Red Hat:rhel_aus:8.6::appstream | All versions | 0:1.2.57-5.el8_6.1 |
libpng15 Red Hat:rhel_aus:8.6::appstream | All versions | 0:1.5.30-7.el8_6.1 |
libpng15-debuginfo Red Hat:rhel_aus:8.6::appstream | All versions | 0:1.5.30-7.el8_6.1 |
libpng15-debugsource Red Hat:rhel_aus:8.6::appstream | All versions | 0:1.5.30-7.el8_6.1 |
libpng12 Red Hat:rhel_e4s:8.6::appstream | All versions | 0:1.2.57-5.el8_6.1 |
libpng15 Red Hat:rhel_e4s:8.6::appstream | All versions | 0:1.5.30-7.el8_6.1 |
libpng15-debuginfo Red Hat:rhel_e4s:8.6::appstream | All versions | 0:1.5.30-7.el8_6.1 |
libpng15-debugsource Red Hat:rhel_e4s:8.6::appstream | All versions | 0:1.5.30-7.el8_6.1 |
libpng12 Red Hat:rhel_e4s:8.8::appstream | All versions | 0:1.2.57-5.el8_8.1 |
libpng15 Red Hat:rhel_e4s:8.8::appstream | All versions | 0:1.5.30-7.el8_8.1 |
libpng15-debuginfo Red Hat:rhel_e4s:8.8::appstream | All versions | 0:1.5.30-7.el8_8.1 |
libpng15-debugsource Red Hat:rhel_e4s:8.8::appstream | All versions | 0:1.5.30-7.el8_8.1 |
libpng15 Red Hat:rhel_e4s:9.0::appstream | All versions | 0:1.5.30-14.el9_0.1 |
libpng15-debuginfo Red Hat:rhel_e4s:9.0::appstream | All versions | 0:1.5.30-14.el9_0.1 |
libpng15-debugsource Red Hat:rhel_e4s:9.0::appstream | All versions | 0:1.5.30-14.el9_0.1 |
libpng15 Red Hat:rhel_e4s:9.2::appstream | All versions | 0:1.5.30-14.el9_2.1 |
libpng15-debuginfo Red Hat:rhel_e4s:9.2::appstream | All versions | 0:1.5.30-14.el9_2.1 |
libpng15-debugsource Red Hat:rhel_e4s:9.2::appstream | All versions | 0:1.5.30-14.el9_2.1 |
libpng Red Hat:rhel_els:7 | All versions | 2:1.5.13-8.el7_9.2 |
Products include Libpng Libpng.
How do I fix CVE-2026-25646?
Upgrade png to 0.1-9 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-25646 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25646 exists.
Other vulnerabilities in Libpng Libpng
- CVE-2017-12652 Denial of service in n/a
- CVE-2018-14550 Out-of-bounds write in libpng
- CVE-2026-33636 LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64
- CVE-2026-33416 LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`
- CVE-2016-10087 Null dereference in n/a
Sources
Also known as ALPINE-CVE-2026-25646, ALSA-2026:3031, ALSA-2026:6439, ALSA-2026:6445, AZL-77409, AZL-77441 and 59 more.