CVE-2025-64505 — LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index

Affected: pnggroup libpng

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.

USN-7924-1 — libpng1.6 vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: libpng1.6, Ubuntu:Pro:18.04:LTS: libpng1.6, Ubuntu:Pro:20.04:LTS: libpng1.6, Ubuntu:22.04:LTS: libpng1.6, Ubuntu:24.04:LTS: libpng1.6, Ubuntu:25.10: libpng1.6

It was discovered that libpng incorrectly handled memory when processing certain PNG files, which could result in an out-of-bounds memory access. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2025-64505)

It was discovered that libpng incorrectly handled memory when processing 8-bit images through the simplified write API with 'convert_to_8bit' enabled, which could result in an out-of-bounds memory access. If a user or automated system were tricked into opening a specially crafted 8-bit PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2025-64506)

It was discovered that libpng incorrectly handled memory when processing palette images with 'PNG_FLAG_OPTIMIZE_ALPHA' enabled, which could result in an out-of-bounds memory access. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2025-64720)

It was discovered that libpng incorrectly handled memory when processing 6-bit interlaced PNGs with 8-bit output format, which could result in an out-of-bounds memory access. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2025-65018)

Most recent entries from all

CVE-2025-64505 — LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index

USN-7924-1 — libpng1.6 vulnerabilities