CVE-2025-64506
Medium · 6.1CVSS
6.1
EPSS
0.1%
Published
Nov 24, 2025
CISA due date
—
The record
LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | libpng | 0 | 1.6.38-1.1.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | libpng16 | 0 | 1.6.40-150600.3.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libpng16 | 0 | 1.6.40-150600.3.3.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libpng16 | 0 | 1.6.8-15.9.1 |
| openSUSE:Leap 15.6 | libpng16 | 0 | 1.6.40-150600.3.3.1 |
| openSUSE:Leap 16.0 | libpng16 | 0 | 1.6.44-160000.3.1 |
| openSUSE:Tumbleweed | libpng16 | 0 | 1.6.51-1.1 |
Related vulnerabilities
- CVE-2026-25646 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
- CVE-2026-22801 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
- CVE-2026-22695 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
- CVE-2025-66293 LIBPNG has an out-of-bounds read in png_image_read_composite Also affects libpng
- CVE-2025-65018 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via… Also affects libpng
- CVE-2025-64720 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect… Also affects libpng
- CVE-2025-64505 LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette… Also affects libpng
- CVE-2026-33636 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng16