Read the docs
TI-2025-40767 Aliases CVE-2025-66293

LIBPNG has an out-of-bounds read in png_image_read_composite

Priority MEDIUM 64CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Partial Red Hat: 39 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial libpng (pnggroup): 1.6.52Red Hat: 28 advisoriesRed Hat: 39 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnggrouplibpngbefore 1.6.521.6.52Patch availableCNA
  • libpng Vendorpnggroup Affected before 1.6.52 Fixed in 1.6.52 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*before 1.6.52Vulnerablepnggroup
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions before 1.6.52 Vulnerable ·pnggroup

Remediation

  • Fix · CNA libpng (pnggroup) Fixed in 1.6.52

Red Hat 28 advisories

  • RHSA-2026:80330 Released 2026-10-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.58-2.1.hum1@aarch64, libpng-1.6.58-2.1.hum1@s390x, libpng-1.6.58-2.1.hum1@src +10
  • RHSA-2026:9690 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 21.0.11 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 21.0.11
  • RHSA-2026:9684 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 8u492 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 8u492
Show 25 more Red Hat advisories
  • RHSA-2026:9687 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 17.0.19 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 17.0.9
  • RHSA-2026:9255 Released 2026-04-22 · Red Hat rating Important
    OpenJDK 11.0.31 ELS Security Update for Portable Linux Builds
    • OPENJDK ELS 11.0.31
  • RHSA-2026:6732 Released 2026-04-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.56-1.hum1@aarch64, libpng-1.6.56-1.hum1@src, libpng-1.6.56-1.hum1@x86_64 +6
  • RHSA-2026:4419 Released 2026-03-19 · Red Hat rating Important
    OpenShift Container Platform 4.15.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202603101737-0, rhcos-ppc64le-415.92.202603101737-0, rhcos-s390x-415.92.202603101737-0 +1
  • RHSA-2026:3861 Released 2026-03-12 · Red Hat rating Important
    OpenShift Container Platform 4.12.86 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202603041314-0
  • RHSA-2026:3415 Released 2026-03-05 · Red Hat rating Important
    OpenShift Container Platform 4.13.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202602240113-0
  • RHSA-2026:2974 Released 2026-02-26 · Red Hat rating Important
    OpenShift Container Platform 4.14.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202602171627-0, rhcos-ppc64le-414.92.202602171627-0, rhcos-s390x-414.92.202602171627-0 +1
  • RHSA-2026:2671 Released 2026-02-18 · Red Hat rating Important
    OpenShift Container Platform 4.17.49 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202602090846-0, rhcos-ppc64le-417.94.202602090846-0, rhcos-s390x-417.94.202602090846-0 +1
  • RHSA-2026:2633 Released 2026-02-18 · Red Hat rating Important
    OpenShift Container Platform 4.19.24 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202602112047-0, rhcos-aarch64-9.6.20260211-0, rhcos-ppc64le-4.19.9.6.202602112047-0 +5
  • RHSA-2026:2659 Released 2026-02-18 · Red Hat rating Important
    OpenShift Container Platform 4.16.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202602101357-0, rhcos-ppc64le-416.94.202602101357-0, rhcos-s390x-416.94.202602101357-0 +1
  • RHSA-2026:2072 Released 2026-02-11 · Red Hat rating Important
    OpenShift Container Platform 4.18.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202602022246-0, rhcos-ppc64le-418.94.202602022246-0, rhcos-s390x-418.94.202602022246-0 +1
  • RHSA-2026:0414 Released 2026-01-08 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:0322 Released 2026-01-08 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libpng-2:1.6.34-8.el8_6.1, libpng-devel-2:1.6.34-8.el8_6.1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libpng-2:1.6.34-8.el8_6.1, libpng-devel-2:1.6.34-8.el8_6.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libpng-2:1.6.34-8.el8_6.1, libpng-devel-2:1.6.34-8.el8_6.1
  • RHSA-2026:0313 Released 2026-01-08 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libpng-2:1.6.34-8.el8_8.1, libpng-devel-2:1.6.34-8.el8_8.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libpng-2:1.6.34-8.el8_8.1, libpng-devel-2:1.6.34-8.el8_8.1
  • RHSA-2026:0321 Released 2026-01-08 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libpng-2:1.6.34-8.el8_4.1, libpng-devel-2:1.6.34-8.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libpng-2:1.6.34-8.el8_4.1, libpng-devel-2:1.6.34-8.el8_4.1
  • RHSA-2026:0323 Released 2026-01-08 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libpng-2:1.6.34-8.el8_2.1, libpng-devel-2:1.6.34-8.el8_2.1
  • RHSA-2026:0241 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS (v. 8) libpng-2:1.6.34-9.el8_10, libpng-devel-2:1.6.34-9.el8_10
  • RHSA-2026:0238 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-12.el9_7.1, libpng-devel-2:1.6.37-12.el9_7.1
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-12.el9_7.1
  • RHSA-2026:0237 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-8.el10_1.1, libpng-devel-2:1.6.40-8.el10_1.1
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-8.el10_1.1
  • RHSA-2026:0234 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libpng-2:1.6.37-12.el9_0.1, libpng-devel-2:1.6.37-12.el9_0.1
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libpng-2:1.6.37-12.el9_0.1
  • RHSA-2026:0210 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng-2:1.6.37-12.el9_6.1, libpng-devel-2:1.6.37-12.el9_6.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libpng-2:1.6.37-12.el9_6.1
  • RHSA-2026:0211 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpng-2:1.6.37-12.el9_4.1, libpng-devel-2:1.6.37-12.el9_4.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libpng-2:1.6.37-12.el9_4.1
  • RHSA-2026:0216 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng-2:1.6.37-12.el9_2.1, libpng-devel-2:1.6.37-12.el9_2.1
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libpng-2:1.6.37-12.el9_2.1
  • RHSA-2026:0212 Released 2026-01-07 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.1, libpng-devel-2:1.6.40-8.el10_0.1
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.1
  • RHSA-2026:0125 Released 2026-01-06 · Red Hat rating Important
    mingw-libpng security update
    • Red Hat Enterprise Linux CRB (v. 8) mingw-libpng-1.6.34-1.el8_10, mingw32-libpng-1.6.34-1.el8_10, mingw32-libpng-static-1.6.34-1.el8_10 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
OPENJDK ELS 11.0.31Fixed RHSA-2026:9255
Red Hat Build of OpenJDK 17.0.9Fixed RHSA-2026:9687
Red Hat Build of OpenJDK 21.0.11Fixed RHSA-2026:9690
Red Hat Build of OpenJDK 25.0.2Fixed—
Red Hat Build of OpenJDK 8u492Fixed RHSA-2026:9684
Red Hat Discovery 2Fixed RHSA-2026:0414
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:0237
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:0238
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:0234
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:0216
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:0212
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:0211
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:0210
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:0237
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:0241
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:0238
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:0323
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:0321
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:0322
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:0322
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:0313
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:0234
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:0216
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:0212
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:0211
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:0210
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:0321
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:0322
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:0313
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:0125
Red Hat Hardened ImagesFixed RHSA-2026:6732, RHSA-2026:80330
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:3861
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:3415
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:2974
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:4419
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:2659
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:2671
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:2072
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:2633
Not affected: 8 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat build of OpenJDK 11 ELS
  • Red Hat build of OpenJDK 17
  • Red Hat build of OpenJDK 21

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66293
  2. 2026-10-09 Fix available: RHSA-2026:9255 · Red Hat
  3. 2026-10-09 Fix available: OPENJDK ELS 11.0.31, Red Hat Build of OpenJDK 25.0.2 · Red Hat
  4. 2026-10-12 Fix available: RHSA-2026:80330 · Red Hat
  5. 2026-10-12 Affected versions changed · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:9684 · Red Hat
  7. 2026-10-30 Fix available: RHSA-2026:9690 · Red Hat
  8. 2026-10-30 Fix available: Red Hat Build of OpenJDK 21.0.11, Red Hat Build of OpenJDK 8u492 · Red Hat
  9. 2026-10-31 Fix available: RHSA-2026:9687 · Red Hat
  10. 2026-10-31 Fix available: Red Hat Build of OpenJDK 17.0.9 · Red Hat

References

Exploit 2

Patch 2

  • TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
  • TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2026-20746 LIBPNG has a heap buffer overflow in png_set_quantize CVSS 4.0HIGH 8.3
  • TI-2025-40204 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` CVSS 3.1HIGH 7.1
  • TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
  • TI-2025-20736 Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a… CVSS 3.1MEDIUM 5.5
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences