LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mingw32-libpngUpgrade libpngUpgrade mingw64-libpngUpgrade mingw32-libpng-staticUpgrade libpng-develUpgrade mingw64-libpng-static | Mar 3, 2026 | Feb 26, 2026 |
| Alpine Linux | — | Upgrade libpng | Jan 23, 2026 | Jan 12, 2026 |
| Amazon Linux Ami 2 | — | Upgrade firefoxUpgrade thunderbird | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libpng-staticUpgrade libpng-toolsUpgrade libpng-tools-debuginfoUpgrade libpng-debuginfoUpgrade libpng-debugsourceUpgrade firefox-debuginfoUpgrade libpng-develUpgrade firefox-debugsourceUpgrade firefoxUpgrade libpng-devel-debuginfoUpgrade libpng | Feb 10, 2026 | Jan 12, 2026 |
| Debian | — | Upgrade libpng1.6 | Feb 19, 2026 | Feb 19, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libpng | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libpng | Mar 10, 2026 | Mar 10, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | May 12, 2026 |
| Oracle_linux | — | Upgrade mingw32-libpngUpgrade mingw32-libpng-staticUpgrade libpng-develUpgrade mingw64-libpng-staticUpgrade mingw64-libpngUpgrade libpng | Mar 2, 2026 | Jan 12, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Jan 12, 2026 |
| Redhat_linux | — | Upgrade libpng-debuginfoUpgrade java-11-openjdk-jmods-fastdebugUpgrade libpng-develUpgrade mingw32-libpngUpgrade java-11-openjdk-debugsourceUpgrade java-11-openjdk-slowdebug-debuginfoUpgrade java-11-openjdk-jmodsUpgrade mingw32-libpng-staticUpgrade java-11-openjdk-jmods-debugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-11-openjdk-headless-debuginfoUpgrade mingw32-libpng-debuginfoUpgrade java-11-openjdk-src-slowdebugUpgrade java-11-openjdk-headlessUpgrade libpng-devel-debuginfoUpgrade mingw64-libpng-debuginfoUpgrade java-11-openjdk-headless-debugUpgrade libpng-tools-debuginfoUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-develUpgrade libpngUpgrade java-11-openjdk-demoUpgrade java-11-openjdk-devel-slowdebug-debuginfoUpgrade java-11-openjdk-devel-debugUpgrade java-11-openjdk-javadocUpgrade mingw64-libpngUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-devel-fastdebug-debuginfoUpgrade java-11-openjdk-javadoc-zip-debugUpgrade java-11-openjdkUpgrade java-11-openjdk-javadoc-zipUpgrade java-11-openjdk-debugUpgrade java-11-openjdk-javadoc-debugUpgrade java-11-openjdk-static-libs-debugUpgrade java-11-openjdk-slowdebugUpgrade java-11-openjdk-static-libs-slowdebugUpgrade mingw64-libpng-staticUpgrade java-11-openjdk-devel-debuginfoUpgrade java-11-openjdk-headless-slowdebug-debuginfoUpgrade java-11-openjdk-demo-debugUpgrade java-11-openjdk-headless-fastdebug-debuginfoUpgrade java-11-openjdk-demo-fastdebugNo solution existsUpgrade java-11-openjdk-demo-slowdebugUpgrade java-11-openjdk-devel-fastdebugUpgrade libpng-debugsourceUpgrade java-11-openjdk-src-debugUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-static-libsUpgrade java-11-openjdk-fastdebug-debuginfoUpgrade java-11-openjdk-debuginfoUpgrade java-11-openjdk-srcUpgrade java-11-openjdk-fastdebug | Mar 3, 2026 | Jan 12, 2026 |
| Rocky_linux | — | Upgrade libpng-devel-debuginfoUpgrade libpng-develUpgrade libpngUpgrade libpng-debuginfoUpgrade libpng-debugsource | Mar 2, 2026 | Feb 28, 2026 |
| Suse | — | Upgrade libpng16-develUpgrade libpng16-compat-develUpgrade libpng16-16-x86-64-v3Upgrade libpng16-16Upgrade libpng16-compat-devel-32bitUpgrade libpng16-toolsUpgrade libpng16-16-32bitUpgrade libpng16-devel-x86-64-v3Upgrade libpng16-compat-devel-x86-64-v3Upgrade libpng16-devel-32bit | Jan 22, 2026 | Jan 21, 2026 |
| Ubuntu | — | Upgrade libpng16-16t64Upgrade libpng16-16Upgrade libpng16-16 (Ubuntu Pro) | Jan 15, 2026 | Jan 12, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub