Read the docs
TI-2026-18222 Aliases CVE-2026-22695

LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)

Priority LOW 31CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 52 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00222 12th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial libpng (pnggroup): 1.6.54Red Hat: 31 advisoriesRed Hat: 52 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnggrouplibpngbefore 1.6.541.6.54Patch availableCNA
  • libpng Vendorpnggroup Affected before 1.6.54 Fixed in 1.6.54 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*1.6.51 to before 1.6.54Vulnerablepnggroup
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions 1.6.51 to before 1.6.54 Vulnerable ·pnggroup

Remediation

  • Fix · CNA libpng (pnggroup) Fixed in 1.6.54

Red Hat 31 advisories

  • RHSA-2026:80330 Released 2026-10-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.58-2.1.hum1@aarch64, libpng-1.6.58-2.1.hum1@s390x, libpng-1.6.58-2.1.hum1@src +10
  • RHSA-2026:16174 Released 2026-05-12 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:12274 Released 2026-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.12.88 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202604281506-0
Show 28 more Red Hat advisories
  • RHSA-2026:9689 Released 2026-04-24 · Red Hat rating Important
    java-21-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 10) java-21-openjdk-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-2.el10_2 +6
    • Red Hat Enterprise Linux AppStream (v. 8) java-21-openjdk-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-1:21.0.11.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-21-openjdk-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-1:21.0.11.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) java-21-openjdk-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-1.el10_2 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el9 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el10_2 +11
  • RHSA-2026:9683 Released 2026-04-24 · Red Hat rating Important
    java-1.8.0-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat Enterprise Linux AppStream (v. 8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream (v. 9) java-1.8.0-openjdk-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-2.el9 +4
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux CRB (v. 8) java-1.8.0-openjdk-accessibility-fastdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-slowdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-2.el9 +7
  • RHSA-2026:9686 Released 2026-04-24 · Red Hat rating Important
    java-17-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-1:17.0.19.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8 +20
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-2.el9 +11
  • RHSA-2026:9690 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 21.0.11 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 21.0.11
  • RHSA-2026:9694 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 25.0.3 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 25.0.3
  • RHSA-2026:9684 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 8u492 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 8u492
  • RHSA-2026:9687 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 17.0.19 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 17.0.9
  • RHSA-2026:9255 Released 2026-04-22 · Red Hat rating Important
    OpenJDK 11.0.31 ELS Security Update for Portable Linux Builds
    • OPENJDK ELS 11.0.31
  • RHSA-2026:9254 Released 2026-04-22 · Red Hat rating Important
    Java 11 OpenJDK ELS Security Update
    • Red Hat OpenJDK 11 ELS for RHEL 7 java-11-openjdk-1:11.0.31.0.11-1.el7_9, java-11-openjdk-debug-1:11.0.31.0.11-1.el7_9, java-11-openjdk-demo-1:11.0.31.0.11-1.el7_9 +15
    • Red Hat OpenJDK 11 ELS for RHEL 8 java-11-openjdk-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el8 +20
    • Red Hat OpenJDK 11 ELS for RHEL 9 java-11-openjdk-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el9 +20
  • RHSA-2026:8748 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:8746 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:8747 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:6732 Released 2026-04-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.56-1.hum1@aarch64, libpng-1.6.56-1.hum1@src, libpng-1.6.56-1.hum1@x86_64 +6
  • RHSA-2026:5606 Released 2026-03-24 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:4728 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS (v. 8) libpng-2:1.6.34-10.el8_10, libpng-devel-2:1.6.34-10.el8_10
  • RHSA-2026:4730 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
  • RHSA-2026:4729 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libpng-2:1.6.34-8.el8_8.2, libpng-devel-2:1.6.34-8.el8_8.2
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libpng-2:1.6.34-8.el8_8.2, libpng-devel-2:1.6.34-8.el8_8.2
  • RHSA-2026:4732 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libpng-2:1.6.34-8.el8_2.2, libpng-devel-2:1.6.34-8.el8_2.2
  • RHSA-2026:4731 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libpng-2:1.6.34-8.el8_4.2, libpng-devel-2:1.6.34-8.el8_4.2
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libpng-2:1.6.34-8.el8_4.2, libpng-devel-2:1.6.34-8.el8_4.2
  • RHSA-2026:4501 Released 2026-03-12 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:4306 Released 2026-03-11 · Red Hat rating Important
    mingw-libpng security update
    • Red Hat Enterprise Linux CRB (v. 8) mingw-libpng-1.6.34-2.el8_10, mingw32-libpng-1.6.34-2.el8_10, mingw32-libpng-static-1.6.34-2.el8_10 +2
  • RHSA-2026:3577 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.2, libpng-devel-2:1.6.40-8.el10_0.2
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.2
  • RHSA-2026:3576 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng-2:1.6.37-12.el9_6.2, libpng-devel-2:1.6.37-12.el9_6.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libpng-2:1.6.37-12.el9_6.2
  • RHSA-2026:3574 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpng-2:1.6.37-12.el9_4.2, libpng-devel-2:1.6.37-12.el9_4.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libpng-2:1.6.37-12.el9_4.2
  • RHSA-2026:3575 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng-2:1.6.37-12.el9_2.2, libpng-devel-2:1.6.37-12.el9_2.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libpng-2:1.6.37-12.el9_2.2
  • RHSA-2026:3573 Released 2026-03-02 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libpng-2:1.6.37-12.el9_0.2, libpng-devel-2:1.6.37-12.el9_0.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libpng-2:1.6.37-12.el9_0.2
  • RHSA-2026:3551 Released 2026-03-02 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-8.el10_1.2, libpng-devel-2:1.6.40-8.el10_1.2
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-8.el10_1.2
  • RHSA-2026:3405 Released 2026-02-26 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-12.el9_7.2, libpng-devel-2:1.6.37-12.el9_7.2
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-12.el9_7.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
OPENJDK ELS 11.0.31Fixed RHSA-2026:9255
Red Hat AI Inference Server 3.3Fixed RHSA-2026:16174, RHSA-2026:8746, RHSA-2026:8747, RHSA-2026:8748
Red Hat Build of OpenJDK 17.0.9Fixed RHSA-2026:9687
Red Hat Build of OpenJDK 21.0.11Fixed RHSA-2026:9690
Red Hat Build of OpenJDK 25.0.2Fixed—
Red Hat Build of OpenJDK 25.0.3Fixed RHSA-2026:9694
Red Hat Build of OpenJDK 8u492Fixed RHSA-2026:9684
Red Hat Ceph Storage 8Fixed RHSA-2026:5606
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Discovery 2Fixed RHSA-2026:4501
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:3551, RHSA-2026:9689
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:3405, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:9683
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:3573, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:3575, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:3577, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:3574, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:3576, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:3551
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:4728
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:3405
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:4732
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:4731
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:4729
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:3573
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:3575
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:3577
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:3574
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:3576
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:4731
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:4729
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:4306, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:9689
Red Hat Hardened ImagesFixed RHSA-2026:6732, RHSA-2026:80330
Red Hat OpenJDK 11 ELS for RHEL 7Fixed RHSA-2026:9254
Red Hat OpenJDK 11 ELS for RHEL 8Fixed RHSA-2026:9254
Red Hat OpenJDK 11 ELS for RHEL 9Fixed RHSA-2026:9254
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:12274
Not affected: 10 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat build of OpenJDK 11 ELS
  • Red Hat build of OpenJDK 17
  • Red Hat build of OpenJDK 21
  • Red Hat build of OpenJDK 25

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22695
  2. 2026-10-09 Fix available: RHSA-2026:9255 · Red Hat
  3. 2026-10-09 Fix available: OPENJDK ELS 11.0.31, Red Hat Build of OpenJDK 25.0.2 · Red Hat
  4. 2026-10-12 Fix available: RHSA-2026:80330 · Red Hat
  5. 2026-10-12 Affected versions changed · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:9684 · Red Hat
  7. 2026-10-30 Fix available: RHSA-2026:9694 · Red Hat
  8. 2026-10-30 Fix available: RHSA-2026:9690 · Red Hat
  9. 2026-10-30 Fix available: Red Hat Build of OpenJDK 21.0.11, Red Hat Build of OpenJDK 25.0.3, Red Hat Build of OpenJDK 8u492 · Red Hat
  10. 2026-10-31 Fix available: RHSA-2026:9687 · Red Hat
  11. 2026-10-31 Fix available: Red Hat Build of OpenJDK 17.0.9 · Red Hat

References

Exploit 2

Patch 2

  • TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
  • TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2026-20746 LIBPNG has a heap buffer overflow in png_set_quantize CVSS 4.0HIGH 8.3
  • TI-2025-40204 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` CVSS 3.1HIGH 7.1
  • TI-2025-40767 LIBPNG has an out-of-bounds read in png_image_read_composite CVSS 3.1HIGH 7.1
  • TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences