CVE-2026-22801: LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*
LIBPNG has an integer truncation causing heap buffer over-read in pngimagewrite
Other sources
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions pngwriteimage16bit and pngwriteimage8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.54
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22801?
CVE-2026-22801 is considered a medium severity vulnerability due to its potential for causing heap buffer over-reads.
How do I fix CVE-2026-22801?
To fix CVE-2026-22801, upgrade LibPNG to version 1.6.54 or later, where the vulnerability has been resolved.
What versions of LibPNG are affected by CVE-2026-22801?
CVE-2026-22801 affects LibPNG versions from 1.6.26 to 1.6.53.
What kind of issue is CVE-2026-22801?
CVE-2026-22801 is an integer truncation issue that leads to a heap buffer over-read.
Is CVE-2026-22801 exploitable remotely?
Yes, CVE-2026-22801 may be exploited remotely if an application processes untrusted PNG images.