Read the docs
TI-2026-18319 Aliases CVE-2026-22801

LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*

Priority LOW 33CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 52 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00134 2nd percentileScored 2026-11-07
Fix Partial libpng (pnggroup): 1.6.54Red Hat: 31 advisoriesRed Hat: 52 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnggrouplibpngbefore 1.6.541.6.54Patch availableCNA
  • libpng Vendorpnggroup Affected before 1.6.54 Fixed in 1.6.54 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*1.6.26 to before 1.6.54Vulnerablepnggroup
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions 1.6.26 to before 1.6.54 Vulnerable ·pnggroup

Remediation

  • Fix · CNA libpng (pnggroup) Fixed in 1.6.54

Red Hat 31 advisories

  • RHSA-2026:80330 Released 2026-10-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.58-2.1.hum1@aarch64, libpng-1.6.58-2.1.hum1@s390x, libpng-1.6.58-2.1.hum1@src +10
  • RHSA-2026:16174 Released 2026-05-12 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:12274 Released 2026-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.12.88 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202604281506-0
Show 28 more Red Hat advisories
  • RHSA-2026:9689 Released 2026-04-24 · Red Hat rating Important
    java-21-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 10) java-21-openjdk-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-2.el10_2 +6
    • Red Hat Enterprise Linux AppStream (v. 8) java-21-openjdk-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-1:21.0.11.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-21-openjdk-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-1:21.0.11.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) java-21-openjdk-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-1.el10_2 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el9 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el10_2 +11
  • RHSA-2026:9683 Released 2026-04-24 · Red Hat rating Important
    java-1.8.0-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat Enterprise Linux AppStream (v. 8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream (v. 9) java-1.8.0-openjdk-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-2.el9 +4
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux CRB (v. 8) java-1.8.0-openjdk-accessibility-fastdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-slowdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-2.el9 +7
  • RHSA-2026:9686 Released 2026-04-24 · Red Hat rating Important
    java-17-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-1:17.0.19.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8 +20
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-2.el9 +11
  • RHSA-2026:9690 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 21.0.11 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 21.0.11
  • RHSA-2026:9694 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 25.0.3 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 25.0.3
  • RHSA-2026:9684 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 8u492 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 8u492
  • RHSA-2026:9687 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 17.0.19 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 17.0.9
  • RHSA-2026:9255 Released 2026-04-22 · Red Hat rating Important
    OpenJDK 11.0.31 ELS Security Update for Portable Linux Builds
    • OPENJDK ELS 11.0.31
  • RHSA-2026:9254 Released 2026-04-22 · Red Hat rating Important
    Java 11 OpenJDK ELS Security Update
    • Red Hat OpenJDK 11 ELS for RHEL 7 java-11-openjdk-1:11.0.31.0.11-1.el7_9, java-11-openjdk-debug-1:11.0.31.0.11-1.el7_9, java-11-openjdk-demo-1:11.0.31.0.11-1.el7_9 +15
    • Red Hat OpenJDK 11 ELS for RHEL 8 java-11-openjdk-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el8 +20
    • Red Hat OpenJDK 11 ELS for RHEL 9 java-11-openjdk-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el9 +20
  • RHSA-2026:8748 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:8746 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:8747 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:6732 Released 2026-04-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.56-1.hum1@aarch64, libpng-1.6.56-1.hum1@src, libpng-1.6.56-1.hum1@x86_64 +6
  • RHSA-2026:5606 Released 2026-03-24 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:4728 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS (v. 8) libpng-2:1.6.34-10.el8_10, libpng-devel-2:1.6.34-10.el8_10
  • RHSA-2026:4730 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
  • RHSA-2026:4729 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libpng-2:1.6.34-8.el8_8.2, libpng-devel-2:1.6.34-8.el8_8.2
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libpng-2:1.6.34-8.el8_8.2, libpng-devel-2:1.6.34-8.el8_8.2
  • RHSA-2026:4732 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libpng-2:1.6.34-8.el8_2.2, libpng-devel-2:1.6.34-8.el8_2.2
  • RHSA-2026:4731 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libpng-2:1.6.34-8.el8_4.2, libpng-devel-2:1.6.34-8.el8_4.2
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libpng-2:1.6.34-8.el8_4.2, libpng-devel-2:1.6.34-8.el8_4.2
  • RHSA-2026:4501 Released 2026-03-12 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:4306 Released 2026-03-11 · Red Hat rating Important
    mingw-libpng security update
    • Red Hat Enterprise Linux CRB (v. 8) mingw-libpng-1.6.34-2.el8_10, mingw32-libpng-1.6.34-2.el8_10, mingw32-libpng-static-1.6.34-2.el8_10 +2
  • RHSA-2026:3577 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.2, libpng-devel-2:1.6.40-8.el10_0.2
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.2
  • RHSA-2026:3576 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng-2:1.6.37-12.el9_6.2, libpng-devel-2:1.6.37-12.el9_6.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libpng-2:1.6.37-12.el9_6.2
  • RHSA-2026:3574 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpng-2:1.6.37-12.el9_4.2, libpng-devel-2:1.6.37-12.el9_4.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libpng-2:1.6.37-12.el9_4.2
  • RHSA-2026:3575 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng-2:1.6.37-12.el9_2.2, libpng-devel-2:1.6.37-12.el9_2.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libpng-2:1.6.37-12.el9_2.2
  • RHSA-2026:3573 Released 2026-03-02 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libpng-2:1.6.37-12.el9_0.2, libpng-devel-2:1.6.37-12.el9_0.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libpng-2:1.6.37-12.el9_0.2
  • RHSA-2026:3551 Released 2026-03-02 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-8.el10_1.2, libpng-devel-2:1.6.40-8.el10_1.2
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-8.el10_1.2
  • RHSA-2026:3405 Released 2026-02-26 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-12.el9_7.2, libpng-devel-2:1.6.37-12.el9_7.2
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-12.el9_7.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
OPENJDK ELS 11.0.31Fixed RHSA-2026:9255
Red Hat AI Inference Server 3.3Fixed RHSA-2026:16174, RHSA-2026:8746, RHSA-2026:8747, RHSA-2026:8748
Red Hat Build of OpenJDK 17.0.9Fixed RHSA-2026:9687
Red Hat Build of OpenJDK 21.0.11Fixed RHSA-2026:9690
Red Hat Build of OpenJDK 25.0.2Fixed—
Red Hat Build of OpenJDK 25.0.3Fixed RHSA-2026:9694
Red Hat Build of OpenJDK 8u492Fixed RHSA-2026:9684
Red Hat Ceph Storage 8Fixed RHSA-2026:5606
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Discovery 2Fixed RHSA-2026:4501
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:3551, RHSA-2026:9689
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:3405, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:9683
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:3573, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:3575, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:3577, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:3574, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:3576, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:3551
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:4728
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:3405
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:4732
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:4731
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:4729
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:3573
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:3575
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:3577
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:3574
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:3576
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:4731
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:4729
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:4306, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:9689
Red Hat Hardened ImagesFixed RHSA-2026:6732, RHSA-2026:80330
Red Hat OpenJDK 11 ELS for RHEL 7Fixed RHSA-2026:9254
Red Hat OpenJDK 11 ELS for RHEL 8Fixed RHSA-2026:9254
Red Hat OpenJDK 11 ELS for RHEL 9Fixed RHSA-2026:9254
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:12274
Not affected: 10 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat build of OpenJDK 11 ELS
  • Red Hat build of OpenJDK 17
  • Red Hat build of OpenJDK 21
  • Red Hat build of OpenJDK 25

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22801
  2. 2026-10-09 Fix available: RHSA-2026:9255 · Red Hat
  3. 2026-10-09 Fix available: OPENJDK ELS 11.0.31, Red Hat Build of OpenJDK 25.0.2 · Red Hat
  4. 2026-10-13 Fix available: RHSA-2026:80330 · Red Hat
  5. 2026-10-13 Affected versions changed · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:9684 · Red Hat
  7. 2026-10-30 Fix available: RHSA-2026:9694 · Red Hat
  8. 2026-10-30 Fix available: RHSA-2026:9690 · Red Hat
  9. 2026-10-30 Fix available: Red Hat Build of OpenJDK 21.0.11, Red Hat Build of OpenJDK 25.0.3, Red Hat Build of OpenJDK 8u492 · Red Hat
  10. 2026-10-31 Fix available: RHSA-2026:9687 · Red Hat
  11. 2026-10-31 Fix available: Red Hat Build of OpenJDK 17.0.9 · Red Hat

References

Advisory 1

  • TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
  • TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2026-20746 LIBPNG has a heap buffer overflow in png_set_quantize CVSS 4.0HIGH 8.3
  • TI-2025-40204 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` CVSS 3.1HIGH 7.1
  • TI-2025-40767 LIBPNG has an out-of-bounds read in png_image_read_composite CVSS 3.1HIGH 7.1
  • TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences