Read the docs
TI-2025-40204 Aliases CVE-2025-65018

LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

Priority HIGH 66CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 48 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00278 20th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial libpng (pnggroup): 1.6.51Red Hat: 27 advisoriesRed Hat: 48 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnggrouplibpng1.6.0 to before 1.6.511.6.51Patch availableCNA
  • libpng Vendorpnggroup Affected 1.6.0 to before 1.6.51 Fixed in 1.6.51 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*1.6.0 to before 1.6.51Vulnerablepnggroup
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions 1.6.0 to before 1.6.51 Vulnerable ·pnggroup

Remediation

  • Fix · CNA libpng (pnggroup) Fixed in 1.6.51

Red Hat 27 advisories

  • RHSA-2026:80330 Released 2026-10-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.58-2.1.hum1@aarch64, libpng-1.6.58-2.1.hum1@s390x, libpng-1.6.58-2.1.hum1@src +10
  • RHSA-2026:6732 Released 2026-04-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.56-1.hum1@aarch64, libpng-1.6.56-1.hum1@src, libpng-1.6.56-1.hum1@x86_64 +6
  • RHSA-2026:0932 Released 2026-01-26 · Red Hat rating Important
    java-1.8.0-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.482.b08-1.el9 +7
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.482.b08-1.el9 +7
    • Red Hat Enterprise Linux AppStream (v. 8) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux AppStream (v. 9) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.482.b08-1.el9 +4
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.482.b08-1.el9 +4
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.482.b08-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.482.b08-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.482.b08-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-1.8.0-openjdk-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.482.b08-1.el8 +5
    • Red Hat Enterprise Linux CRB (v. 8) java-1.8.0-openjdk-accessibility-fastdebug-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-accessibility-slowdebug-1:1.8.0.482.b08-1.el8, java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.482.b08-1.el8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.482.b08-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.482.b08-1.el9 +7
Show 24 more Red Hat advisories
  • RHSA-2026:0933 Released 2026-01-26 · Red Hat rating Important
    java-25-openjdk security update
    • Red Hat Enterprise Linux AppStream (v. 10) java-25-openjdk-1:25.0.2.0.10-1.el10, java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el10, java-25-openjdk-demo-1:25.0.2.0.10-1.el10 +7
    • Red Hat Enterprise Linux AppStream (v. 9) java-25-openjdk-1:25.0.2.0.10-1.el9, java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el9, java-25-openjdk-demo-1:25.0.2.0.10-1.el9 +7
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.2.0.10-1.el10, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.2.0.10-1.el10, java-25-openjdk-demo-fastdebug-1:25.0.2.0.10-1.el10 +13
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.2.0.10-1.el9, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.2.0.10-1.el9, java-25-openjdk-demo-fastdebug-1:25.0.2.0.10-1.el9 +13
  • RHSA-2026:0901 Released 2026-01-26 · Red Hat rating Important
    OpenJDK 25.0.2 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 25.0.2
  • RHSA-2026:0899 Released 2026-01-26 · Red Hat rating Important
    OpenJDK 21.0.10 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 21.0.10
  • RHSA-2026:0897 Released 2026-01-26 · Red Hat rating Important
    OpenJDK 17.0.18 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 17.0.18
  • RHSA-2026:0895 Released 2026-01-26 · Red Hat rating Important
    OpenJDK 8u482 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 8u482
  • RHSA-2026:0928 Released 2026-01-22 · Red Hat rating Important
    java-21-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-21-openjdk-demo-fastdebug-1:21.0.10.0.7-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.10.0.7-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.10.0.7-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-21-openjdk-demo-fastdebug-1:21.0.10.0.7-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.10.0.7-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.10.0.7-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 10) java-21-openjdk-1:21.0.10.0.7-1.el10, java-21-openjdk-demo-1:21.0.10.0.7-1.el10, java-21-openjdk-devel-1:21.0.10.0.7-1.el10 +6
    • Red Hat Enterprise Linux AppStream (v. 8) java-21-openjdk-1:21.0.10.0.7-1.el8, java-21-openjdk-demo-1:21.0.10.0.7-1.el8, java-21-openjdk-devel-1:21.0.10.0.7-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-21-openjdk-1:21.0.10.0.7-1.el9, java-21-openjdk-demo-1:21.0.10.0.7-1.el9, java-21-openjdk-devel-1:21.0.10.0.7-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) java-21-openjdk-1:21.0.10.0.7-1.el10, java-21-openjdk-demo-1:21.0.10.0.7-1.el10, java-21-openjdk-devel-1:21.0.10.0.7-1.el10 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-21-openjdk-1:21.0.10.0.7-1.el9, java-21-openjdk-demo-1:21.0.10.0.7-1.el9, java-21-openjdk-devel-1:21.0.10.0.7-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-21-openjdk-1:21.0.10.0.7-1.el9, java-21-openjdk-demo-1:21.0.10.0.7-1.el9, java-21-openjdk-devel-1:21.0.10.0.7-1.el9 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-21-openjdk-demo-fastdebug-1:21.0.10.0.7-1.el8, java-21-openjdk-demo-slowdebug-1:21.0.10.0.7-1.el8, java-21-openjdk-devel-fastdebug-1:21.0.10.0.7-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-21-openjdk-demo-fastdebug-1:21.0.10.0.7-1.el10, java-21-openjdk-demo-slowdebug-1:21.0.10.0.7-1.el10, java-21-openjdk-devel-fastdebug-1:21.0.10.0.7-1.el10 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-21-openjdk-demo-fastdebug-1:21.0.10.0.7-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.10.0.7-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.10.0.7-1.el9 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) java-21-openjdk-demo-fastdebug-1:21.0.10.0.7-1.el10, java-21-openjdk-demo-slowdebug-1:21.0.10.0.7-1.el10, java-21-openjdk-devel-fastdebug-1:21.0.10.0.7-1.el10 +11
  • RHSA-2026:0927 Released 2026-01-22 · Red Hat rating Important
    java-17-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.18.0.8-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.18.0.8-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el8 +20
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-slowdebug-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-fastdebug-1:17.0.18.0.8-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.18.0.8-1.el9 +11
  • RHSA-2026:0847 Released 2026-01-21 · Red Hat rating Important
    java-11-openjdk ELS security update
    • Red Hat OpenJDK 11 ELS for RHEL 7 java-11-openjdk-1:11.0.30.0.7-1.el7_9, java-11-openjdk-debug-1:11.0.30.0.7-1.el7_9, java-11-openjdk-demo-1:11.0.30.0.7-1.el7_9 +15
    • Red Hat OpenJDK 11 ELS for RHEL 8 java-11-openjdk-1:11.0.30.0.7-1.el8, java-11-openjdk-demo-1:11.0.30.0.7-1.el8, java-11-openjdk-demo-fastdebug-1:11.0.30.0.7-1.el8 +20
    • Red Hat OpenJDK 11 ELS for RHEL 9 java-11-openjdk-1:11.0.30.0.7-1.el9, java-11-openjdk-demo-1:11.0.30.0.7-1.el9, java-11-openjdk-demo-fastdebug-1:11.0.30.0.7-1.el9 +20
  • RHSA-2026:0849 Released 2026-01-21 · Red Hat rating Moderate
    OpenJDK 11.0.30 ELS Security Update for Windows Builds
    • OPENJDK ELS 11.0.30
  • RHSA-2026:0848 Released 2026-01-21 · Red Hat rating Important
    OpenJDK 11.0.30 ELS Security Update for Portable Linux Builds
    • OPENJDK ELS 11.0.30
  • RHSA-2026:0414 Released 2026-01-08 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:0322 Released 2026-01-08 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libpng-2:1.6.34-8.el8_6.1, libpng-devel-2:1.6.34-8.el8_6.1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libpng-2:1.6.34-8.el8_6.1, libpng-devel-2:1.6.34-8.el8_6.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libpng-2:1.6.34-8.el8_6.1, libpng-devel-2:1.6.34-8.el8_6.1
  • RHSA-2026:0313 Released 2026-01-08 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libpng-2:1.6.34-8.el8_8.1, libpng-devel-2:1.6.34-8.el8_8.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libpng-2:1.6.34-8.el8_8.1, libpng-devel-2:1.6.34-8.el8_8.1
  • RHSA-2026:0321 Released 2026-01-08 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libpng-2:1.6.34-8.el8_4.1, libpng-devel-2:1.6.34-8.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libpng-2:1.6.34-8.el8_4.1, libpng-devel-2:1.6.34-8.el8_4.1
  • RHSA-2026:0323 Released 2026-01-08 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libpng-2:1.6.34-8.el8_2.1, libpng-devel-2:1.6.34-8.el8_2.1
  • RHSA-2026:0241 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS (v. 8) libpng-2:1.6.34-9.el8_10, libpng-devel-2:1.6.34-9.el8_10
  • RHSA-2026:0238 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-12.el9_7.1, libpng-devel-2:1.6.37-12.el9_7.1
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-12.el9_7.1
  • RHSA-2026:0237 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-8.el10_1.1, libpng-devel-2:1.6.40-8.el10_1.1
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-8.el10_1.1
  • RHSA-2026:0234 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libpng-2:1.6.37-12.el9_0.1, libpng-devel-2:1.6.37-12.el9_0.1
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libpng-2:1.6.37-12.el9_0.1
  • RHSA-2026:0210 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng-2:1.6.37-12.el9_6.1, libpng-devel-2:1.6.37-12.el9_6.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libpng-2:1.6.37-12.el9_6.1
  • RHSA-2026:0211 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpng-2:1.6.37-12.el9_4.1, libpng-devel-2:1.6.37-12.el9_4.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libpng-2:1.6.37-12.el9_4.1
  • RHSA-2026:0216 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng-2:1.6.37-12.el9_2.1, libpng-devel-2:1.6.37-12.el9_2.1
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libpng-2:1.6.37-12.el9_2.1
  • RHSA-2026:0212 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.1, libpng-devel-2:1.6.40-8.el10_0.1
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.1
  • RHSA-2026:0125 Released 2026-01-06 · Red Hat rating Important
    mingw-libpng security update
    • Red Hat Enterprise Linux CRB (v. 8) mingw-libpng-1.6.34-1.el8_10, mingw32-libpng-1.6.34-1.el8_10, mingw32-libpng-static-1.6.34-1.el8_10 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat build of OpenJDK 11 ELSAffectedNo fix yet
Red Hat build of OpenJDK 17AffectedNo fix yet
Red Hat build of OpenJDK 21AffectedNo fix yet
OPENJDK ELS 11.0.30Fixed RHSA-2026:0848
Red Hat Build of OpenJDK 17.0.18Fixed RHSA-2026:0897
Red Hat Build of OpenJDK 21.0.10Fixed RHSA-2026:0899
Red Hat Build of OpenJDK 25.0.2Fixed RHSA-2026:0901
Red Hat Build of OpenJDK 8u482Fixed RHSA-2026:0895
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:0927, RHSA-2026:0928, RHSA-2026:0932
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:0927, RHSA-2026:0928, RHSA-2026:0932
Red Hat Discovery 2Fixed RHSA-2026:0414
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:0237, RHSA-2026:0928, RHSA-2026:0933
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:0927, RHSA-2026:0928, RHSA-2026:0932
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:0238, RHSA-2026:0927, RHSA-2026:0928, RHSA-2026:0932, RHSA-2026:0933
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:0932
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:0234, RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:0216, RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:0212, RHSA-2026:0928
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:0211, RHSA-2026:0927, RHSA-2026:0928, RHSA-2026:0932
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:0210, RHSA-2026:0927, RHSA-2026:0928, RHSA-2026:0932
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:0927, RHSA-2026:0932
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:0237
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:0241
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:0238
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:0323
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:0321
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:0322
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:0322
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:0313
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:0234
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:0216
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:0212
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:0211
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:0210
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:0321
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:0322
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:0313
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:0125, RHSA-2026:0927, RHSA-2026:0928, RHSA-2026:0932
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:0928, RHSA-2026:0933
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:0927, RHSA-2026:0928, RHSA-2026:0932, RHSA-2026:0933
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:0928
Red Hat Hardened ImagesFixed RHSA-2026:6732, RHSA-2026:80330
Red Hat OpenJDK 11 ELS for RHEL 7Fixed RHSA-2026:0847
Red Hat OpenJDK 11 ELS for RHEL 8Fixed RHSA-2026:0847
Red Hat OpenJDK 11 ELS for RHEL 9Fixed RHSA-2026:0847
Not affected: 5 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-65018
  2. 2026-10-09 Fix available: RHSA-2026:0848 · Red Hat
  3. 2026-10-09 Fix available: RHSA-2026:0849 · Red Hat
  4. 2026-10-09 Fix available: OPENJDK ELS 11.0.30 · Red Hat
  5. 2026-10-12 Fix available: RHSA-2026:80330 · Red Hat
  6. 2026-10-12 Affected versions changed · Red Hat

References

Exploit 2

Patch 2

Other 1

  • TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
  • TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2026-20746 LIBPNG has a heap buffer overflow in png_set_quantize CVSS 4.0HIGH 8.3
  • TI-2025-40767 LIBPNG has an out-of-bounds read in png_image_read_composite CVSS 3.1HIGH 7.1
  • TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
  • TI-2025-20736 Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a… CVSS 3.1MEDIUM 5.5
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences