LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpng | Dec 1, 2025 | Nov 24, 2025 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade firefox | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade firefox-debuginfoUpgrade libpng-debugsourceUpgrade libpng-tools-debuginfoUpgrade libpng-staticUpgrade firefoxUpgrade libpng-toolsUpgrade libpng-debuginfoUpgrade libpng-develUpgrade libpng-devel-debuginfoUpgrade firefox-debugsourceUpgrade libpng | Dec 9, 2025 | Nov 24, 2025 |
| Debian | — | Upgrade libpng1.6 | Dec 8, 2025 | Dec 8, 2025 |
| Freebsd | — | Upgrade png | Dec 10, 2025 | Nov 27, 2025 |
| Gentoo Linux | — | Upgrade media-libs/libpng. | Nov 26, 2025 | Nov 26, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libpng | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libpng | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libpng | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libpng | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 24, 2025 |
| Ubuntu | — | Upgrade libpng16-16t64Upgrade libpng16-16Upgrade libpng16-16 (Ubuntu Pro) | Dec 12, 2025 | Nov 25, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub