LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpng | Dec 1, 2025 | Nov 24, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libpng-develUpgrade libpngUpgrade firefoxUpgrade thunderbirdUpgrade libpng12-debuginfoUpgrade libpng12Upgrade libpng-debuginfoUpgrade libpng12-develUpgrade libpng-static | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libpng-devel-debuginfoUpgrade libpng-staticUpgrade libpng-debuginfoUpgrade libpngUpgrade libpng-develUpgrade firefoxUpgrade libpng-toolsUpgrade firefox-debugsourceUpgrade libpng-tools-debuginfoUpgrade libpng-debugsourceUpgrade firefox-debuginfo | Dec 9, 2025 | Nov 24, 2025 |
| Apple Osx Imageio | — | Upgrade macOS to the latest version | Mar 27, 2026 | Mar 24, 2026 |
| Debian | — | Upgrade libpng1.6 | Dec 8, 2025 | Dec 8, 2025 |
| Freebsd | — | Upgrade png | Dec 10, 2025 | Nov 27, 2025 |
| Gentoo Linux | — | Upgrade media-libs/libpng. | Nov 26, 2025 | Nov 26, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libpng | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libpng | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libpng | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libpng | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 24, 2025 |
| Ubuntu | — | Upgrade libpng12-0 (Ubuntu Pro)Upgrade libpng16-16Upgrade libpng16-16t64Upgrade libpng16-16 (Ubuntu Pro) | Dec 12, 2025 | Nov 25, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub