CVE-2026-25646: LIBPNG has a heap buffer overflow in png_set_quantize
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the pngsetquantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.55Patch CVE-2026-25646
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25646?
CVE-2026-25646 is classified as a high-severity vulnerability due to the potential for heap buffer overflow.
How do I fix CVE-2026-25646?
To fix CVE-2026-25646, upgrade to Libpng version 1.6.55 or later.
What impact does CVE-2026-25646 have on applications using Libpng?
CVE-2026-25646 can lead to arbitrary code execution or data corruption in applications utilizing affected versions of Libpng.
Is my application vulnerable to CVE-2026-25646?
If your application uses Libpng versions prior to 1.6.55, it is vulnerable to CVE-2026-25646.
What should I do if I cannot immediately upgrade to fix CVE-2026-25646?
If immediate upgrade is not possible, mitigate CVE-2026-25646 by restricting untrusted PNG file parsing in your application.