Most recent entries from all

ALSA-2026:0125 — Important: mingw-libpng security update

Affected: AlmaLinux:8: mingw32-libpng, AlmaLinux:8: mingw32-libpng-static, AlmaLinux:8: mingw64-libpng, AlmaLinux:8: mingw64-libpng-static

MinGW Windows Libpng library.

Security Fix(es):

* libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-02925

BELL-CVE-2025-64720

Affected: Alpaquita:23: libpng, Alpaquita:25: libpng, Alpaquita:stream: libpng, BellSoft Hardened Containers:23: libpng, BellSoft Hardened Containers:25: libpng, BellSoft Hardened Containers:stream: libpng

certfr-2025-avi-1064 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2025-avi-1064

EUVD-2026-261883

fkie_cve-2025-64720

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.

msrc_CVE-2025-64720 — LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

msrc_CVE-2025-64720

NCSC-2026-0173 — Kwetsbaarheden verholpen in Google Android en Samsung Mobile

NCSC-2026-0173

OESA-2025-2763 — libpng security update

Affected: openEuler:24.03-LTS-SP1: libpng, openEuler:24.03-LTS-SP2: libpng, openEuler:20.03-LTS-SP4: libpng, openEuler:22.03-LTS-SP3: libpng, openEuler:22.03-LTS-SP4: libpng, openEuler:24.03-LTS: libpng

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fix(es):

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This i…

openSUSE-SU-2025:15781-1 — libpng16-16-1.6.51-1.1 on GA media

libpng16-16-1.6.51-1.1 on GA media

RHSA-2026:0211 — Red Hat Security Advisory: libpng security update

libpng: LIBPNG buffer overflow libpng: LIBPNG heap buffer overflow libpng: LIBPNG out-of-bounds read in png_image_read_composite

SUSE-SU-2025:21217-1 — Security update for libpng16

Security update for libpng16

UBUNTU-CVE-2025-64720

Affected: Ubuntu:Pro:16.04:LTS: libpng1.6, Ubuntu:Pro:18.04:LTS: libpng1.6, Ubuntu:Pro:20.04:LTS: libpng1.6, Ubuntu:22.04:LTS: libpng1.6, Ubuntu:24.04:LTS: libpng1.6, Ubuntu:25.10: libpng1.6

WID-SEC-W-2025-2663 — libpng: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libpng ausnutzen, um einen Denial of Service Angriff durchzuführen und Code auszuführen.