CVE-2026-22695: LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function pngimagefinishread when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.54Patch CVE-2026-22695 - Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.54Patch CVE-2026-22801
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22695?
CVE-2026-22695 is considered a medium severity vulnerability due to its potential for exploitation through heap buffer over-reads.
How do I fix CVE-2026-22695?
To fix CVE-2026-22695, you should upgrade LIBPNG to version 1.6.54 or later, which resolves the heap buffer over-read issue.
What versions of LIBPNG are affected by CVE-2026-22695?
CVE-2026-22695 affects LIBPNG versions from 1.6.51 to 1.6.53.
What type of vulnerability is CVE-2026-22695?
CVE-2026-22695 is categorized as a heap buffer over-read vulnerability.
Which library is affected by CVE-2026-22695?
CVE-2026-22695 affects the LIBPNG library, which is used for handling PNG image files.