Log in Start free

Vulnerability · Published Feb 10, 2026 · Assigned by GitHub_M

CVE-2026-25646LIBPNG has a heap buffer overflow in png_set_quantize

High 7.0

In plain English

A high-severity heap buffer overflow in libpng from pnggroup. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)1.1%top 33.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libpng2:1.6.40-8.el10_1.2ALSA-2026:3551
AlmaLinux:8libpng2:1.6.34-10.el8_10ALSA-2026:4728
AlmaLinux:9libpng2:1.6.37-12.el9_7.2ALSA-2026:3405
AlmaLinux:10libpng-devel2:1.6.40-8.el10_1.2ALSA-2026:3551
AlmaLinux:8libpng-devel2:1.6.34-10.el8_10ALSA-2026:4728
AlmaLinux:9libpng-devel2:1.6.37-12.el9_7.2ALSA-2026:3405
AlmaLinux:8libpng121.2.57-6.el8_10ALSA-2026:6445
AlmaLinux:8libpng151.5.30-8.el8_10ALSA-2026:6439
AlmaLinux:9libpng151.5.30-14.el9_7.1ALSA-2026:3031
AlmaLinux:8mingw32-libpng1.6.34-2.el8_10ALSA-2026:4306
AlmaLinux:8mingw32-libpng-static1.6.34-2.el8_10ALSA-2026:4306
AlmaLinux:8mingw64-libpng1.6.34-2.el8_10ALSA-2026:4306
AlmaLinux:8mingw64-libpng-static1.6.34-2.el8_10ALSA-2026:4306
Alpine:v3.20libpng1.6.55-r0ALPINE-CVE-2026-25646
Alpine:v3.21libpng1.6.55-r0ALPINE-CVE-2026-25646
Alpine:v3.22libpng1.6.55-r0ALPINE-CVE-2026-25646
Alpine:v3.23libpng1.6.55-r0ALPINE-CVE-2026-25646
Alpine:v3.24libpng1.6.55-r0ALPINE-CVE-2026-25646
Debian:12libpng1.61.6.39-2+deb12u3DEBIAN-CVE-2026-25646
Debian:12libpng1.61.6.39-2+deb12u3DSA-6138-1
Debian:13libpng1.61.6.48-1+deb13u3DSA-6138-1
Debian:13libpng1.61.6.48-1+deb13u3DEBIAN-CVE-2026-25646
Debian:14libpng1.61.6.55-1DEBIAN-CVE-2026-25646
Rocky Linux:10libpng2:1.6.40-8.el10_1.2RLSA-2026:3551
Rocky Linux:8libpng2:1.6.34-10.el8_10RLSA-2026:4728
Rocky Linux:9libpng2:1.6.37-12.el9_7.2RLSA-2026:3405
Rocky Linux:8libpng120:1.2.57-6.el8_10RLSA-2026:6445
Rocky Linux:8libpng150:1.5.30-8.el8_10RLSA-2026:6439
Rocky Linux:9libpng150:1.5.30-14.el9_7.1RLSA-2026:3031
Rocky Linux:8mingw-libpng0:1.6.34-2.el8_10RLSA-2026:4306
Ubuntu:22.04:LTSlibpng1.61.6.37-3ubuntu0.4USN-8039-1
Ubuntu:22.04:LTSlibpng1.61.6.37-3ubuntu0.4UBUNTU-CVE-2026-25646
Ubuntu:24.04:LTSlibpng1.61.6.43-5ubuntu0.5UBUNTU-CVE-2026-25646
Ubuntu:24.04:LTSlibpng1.61.6.43-5ubuntu0.5USN-8039-1
Ubuntu:25.10libpng1.61.6.50-1ubuntu0.4USN-8039-1
Ubuntu:25.10libpng1.61.6.50-1ubuntu0.4UBUNTU-CVE-2026-25646
Ubuntu:26.04:LTSlibpng1.61.6.55-1UBUNTU-CVE-2026-25646

Affected products (as reported)

VendorProductVersions
pnggroup libpng < 1.6.55

Weakness: CWE-122, CWE-126, CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

References