CVE-2026-25646

The record

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Affected packages

Related vulnerabilities

• CVE-2026-22801 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
• CVE-2026-22695 LIBPNG is a reference library for use in applications that read, create, and manipulate… Also affects libpng
• CVE-2025-66293 LIBPNG has an out-of-bounds read in png_image_read_composite Also affects libpng
• CVE-2025-65018 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via… Also affects libpng
• CVE-2025-64720 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect… Also affects libpng
• CVE-2025-64506 LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with… Also affects libpng
• CVE-2025-64505 LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette… Also affects libpng
• CVE-2025-28164 Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a… Also affects libpng16