CVE-2026-22801
Medium · 6.8CVSS
6.8
EPSS
0.1%
Published
Jan 12, 2026
CISA due date
—
The record
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | libpng | 0 | 1.6.54-r0 |
| Chainguard | libpng-dev | 0 | 1.6.54-r0 |
| Chainguard | libpng-doc | 0 | 1.6.54-r0 |
| Chainguard | libpng-static | 0 | 1.6.54-r0 |
| Chainguard | libpng-utils | 0 | 1.6.54-r0 |
| Mageia:9 | libpng | 0 | 1.6.38-1.3.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.2 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.3 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.4 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Micro 5.5 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libpng16 | 0 | 1.6.40-150600.3.6.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libpng16 | 0 | 1.6.34-150000.3.19.1 |
| Wolfi | libpng | 0 | 1.6.54-r0 |
| Wolfi | libpng-dev | 0 | 1.6.54-r0 |
| Wolfi | libpng-doc | 0 | 1.6.54-r0 |
| Wolfi | libpng-static | 0 | 1.6.54-r0 |
| Wolfi | libpng-utils | 0 | 1.6.54-r0 |
| openSUSE:Leap 15.6 | libpng16 | 0 | 1.6.40-150600.3.6.1 |
| openSUSE:Leap 16.0 | libpng16 | 0 | 1.6.44-160000.4.1 |
| openSUSE:Tumbleweed | libpng16 | 0 | 1.6.54-1.1 |
Related vulnerabilities
- CVE-2026-22695 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
- CVE-2026-25646 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
- CVE-2025-66293 LIBPNG has an out-of-bounds read in png_image_read_composite Also affects libpng
- CVE-2025-65018 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via… Also affects libpng
- CVE-2025-64720 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect… Also affects libpng
- CVE-2025-64506 LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with… Also affects libpng
- CVE-2025-64505 LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette… Also affects libpng
- CVE-2025-28164 Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a… Also affects libpng16