CVE-2025-28162
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Jan 27, 2026
CISA due date
—
The record
Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.2 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.3 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.4 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.5 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libpng16 | 0 | 1.6.40-150600.3.9.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| openSUSE:Leap 15.6 | libpng16 | 0 | 1.6.40-150600.3.9.1 |
| openSUSE:Leap 16.0 | libpng16 | 0 | 1.6.44-160000.5.1 |
Related vulnerabilities
- CVE-2026-25646 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng16
- CVE-2025-28164 Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a… Also affects libpng16
- CVE-2026-22801 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng16
- CVE-2026-22695 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng16
- CVE-2026-33636 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng16
- CVE-2026-33416 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng16
- CVE-2025-66293 LIBPNG has an out-of-bounds read in png_image_read_composite Also affects libpng16
- CVE-2025-65018 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via… Also affects libpng16