CVE-2026-22695
Medium · 6.1CVSS
6.1
EPSS
0.2%
Published
Jan 12, 2026
CISA due date
—
The record
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | libpng | 0 | 1.6.54-r0 |
| Chainguard | libpng-dev | 0 | 1.6.54-r0 |
| Chainguard | libpng-doc | 0 | 1.6.54-r0 |
| Chainguard | libpng-static | 0 | 1.6.54-r0 |
| Chainguard | libpng-utils | 0 | 1.6.54-r0 |
| Mageia:9 | libpng | 0 | 1.6.38-1.3.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.2 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.3 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.4 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.5 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libpng16 | 0 | 1.6.40-150600.3.6.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| Wolfi | libpng | 0 | 1.6.54-r0 |
| Wolfi | libpng-dev | 0 | 1.6.54-r0 |
| Wolfi | libpng-doc | 0 | 1.6.54-r0 |
| Wolfi | libpng-static | 0 | 1.6.54-r0 |
| Wolfi | libpng-utils | 0 | 1.6.54-r0 |
| openSUSE:Leap 15.6 | libpng16 | 0 | 1.6.40-150600.3.6.1 |
| openSUSE:Leap 16.0 | libpng16 | 0 | 1.6.44-160000.4.1 |
| openSUSE:Tumbleweed | libpng16 | 0 | 1.6.54-1.1 |
Related vulnerabilities
- CVE-2026-22801 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
- CVE-2026-25646 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
- CVE-2025-66293 LIBPNG has an out-of-bounds read in png_image_read_composite Also affects libpng
- CVE-2025-65018 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via… Also affects libpng
- CVE-2025-64720 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect… Also affects libpng
- CVE-2025-64506 LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with… Also affects libpng
- CVE-2025-64505 LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette… Also affects libpng
- CVE-2025-28164 Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a… Also affects libpng16