Read the docs
TI-2026-20746 Aliases CVE-2026-25646

LIBPNG has a heap buffer overflow in png_set_quantize

Priority HIGH 69CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Partial Red Hat: 52 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0112 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial libpng (pnggroup): 1.6.55Red Hat: 51 advisoriesRed Hat: 52 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnggrouplibpngbefore 1.6.551.6.55Patch availableCNA
  • libpng Vendorpnggroup Affected before 1.6.55 Fixed in 1.6.55 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*before 1.6.55Vulnerablepnggroup
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions before 1.6.55 Vulnerable ·pnggroup

Remediation

  • Fix · CNA libpng (pnggroup) Fixed in 1.6.55

Red Hat 51 advisories

  • RHSA-2026:80330 Released 2026-10-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.58-2.1.hum1@aarch64, libpng-1.6.58-2.1.hum1@s390x, libpng-1.6.58-2.1.hum1@src +10
  • RHSA-2026:17596 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.17.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202605112123-0, rhcos-ppc64le-417.94.202605112123-0, rhcos-s390x-417.94.202605112123-0 +1
  • RHSA-2026:14773 Released 2026-05-13 · Red Hat rating Important
    OpenShift Container Platform 4.15.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202605060220-0, rhcos-ppc64le-415.92.202605060220-0, rhcos-s390x-415.92.202605060220-0 +1
Show 48 more Red Hat advisories
  • RHSA-2026:15087 Released 2026-05-13 · Red Hat rating Important
    OpenShift Container Platform 4.14.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202605060243-0, rhcos-ppc64le-414.92.202605060243-0, rhcos-s390x-414.92.202605060243-0 +1
  • RHSA-2026:16174 Released 2026-05-12 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.3 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:12274 Released 2026-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.12.88 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202604281506-0
  • RHSA-2026:10097 Released 2026-04-30 · Red Hat rating Important
    OpenShift Container Platform 4.16.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202604211449-0, rhcos-ppc64le-416.94.202604211449-0, rhcos-s390x-416.94.202604211449-0 +1
  • RHSA-2026:9690 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 21.0.11 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 21.0.11
  • RHSA-2026:9684 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 8u492 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 8u492
  • RHSA-2026:9687 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 17.0.19 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 17.0.9
  • RHSA-2026:9255 Released 2026-04-22 · Red Hat rating Important
    OpenJDK 11.0.31 ELS Security Update for Portable Linux Builds
    • OPENJDK ELS 11.0.31
  • RHSA-2026:8748 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:8746 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:8747 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:7243 Released 2026-04-16 · Red Hat rating Important
    OpenShift Container Platform 4.19.28 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202604080618-0, rhcos-ppc64le-4.19.9.6.202604080618-0, rhcos-s390x-4.19.9.6.202604080618-0 +1
  • RHSA-2026:7239 Released 2026-04-16 · Red Hat rating Important
    OpenShift Container Platform 4.13.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202604080111-0
  • RHSA-2026:7503 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.56-1.1.hum1@aarch64, libpng-1.6.56-1.1.hum1@src, libpng-1.6.56-1.1.hum1@x86_64 +6
  • RHSA-2026:6553 Released 2026-04-09 · Red Hat rating Important
    OpenShift Container Platform 4.18.37 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202603261158-0, rhcos-ppc64le-418.94.202603261158-0, rhcos-s390x-418.94.202603261158-0 +1
  • RHSA-2026:7035 Released 2026-04-08 · Red Hat rating Important
    libpng12 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libpng12-1.2.57-5.el8_2.1
  • RHSA-2026:7032 Released 2026-04-08 · Red Hat rating Important
    libpng12 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libpng12-1.2.50-10.el7_9.1, libpng12-1.2.50-10.el7_9.1.ppc
  • RHSA-2026:7033 Released 2026-04-08 · Red Hat rating Important
    libpng12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libpng12-1.2.57-5.el8_6.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libpng12-1.2.57-5.el8_6.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libpng12-1.2.57-5.el8_6.1
  • RHSA-2026:7034 Released 2026-04-08 · Red Hat rating Important
    libpng12 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libpng12-1.2.57-5.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libpng12-1.2.57-5.el8_8.1
  • RHSA-2026:7036 Released 2026-04-08 · Red Hat rating Important
    libpng12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libpng12-1.2.57-5.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libpng12-1.2.57-5.el8_4.1
  • RHSA-2026:6732 Released 2026-04-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.56-1.hum1@aarch64, libpng-1.6.56-1.hum1@src, libpng-1.6.56-1.hum1@x86_64 +6
  • RHSA-2026:6469 Released 2026-04-02 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libpng15-1.5.30-7.el8_6.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libpng15-1.5.30-7.el8_6.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libpng15-1.5.30-7.el8_6.1
  • RHSA-2026:6468 Released 2026-04-02 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libpng15-1.5.30-7.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libpng15-1.5.30-7.el8_8.1
  • RHSA-2026:6467 Released 2026-04-02 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libpng15-1.5.30-7.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libpng15-1.5.30-7.el8_4.1
  • RHSA-2026:6466 Released 2026-04-02 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libpng15-1.5.30-7.el8_2.1
  • RHSA-2026:6445 Released 2026-04-02 · Red Hat rating Important
    libpng12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libpng12-1.2.57-6.el8_10
  • RHSA-2026:6439 Released 2026-04-02 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libpng15-1.5.30-8.el8_10
  • RHSA-2026:5606 Released 2026-03-24 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:4756 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libpng-2:1.5.13-8.el7_9.2, libpng-2:1.5.13-8.el7_9.2.ppc, libpng-devel-2:1.5.13-8.el7_9.2 +1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libpng-static-2:1.5.13-8.el7_9.2, libpng-static-2:1.5.13-8.el7_9.2.ppc
  • RHSA-2026:4728 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS (v. 8) libpng-2:1.6.34-10.el8_10, libpng-devel-2:1.6.34-10.el8_10
  • RHSA-2026:4730 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libpng-2:1.6.34-8.el8_6.2, libpng-devel-2:1.6.34-8.el8_6.2
  • RHSA-2026:4729 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libpng-2:1.6.34-8.el8_8.2, libpng-devel-2:1.6.34-8.el8_8.2
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libpng-2:1.6.34-8.el8_8.2, libpng-devel-2:1.6.34-8.el8_8.2
  • RHSA-2026:4732 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libpng-2:1.6.34-8.el8_2.2, libpng-devel-2:1.6.34-8.el8_2.2
  • RHSA-2026:4731 Released 2026-03-17 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libpng-2:1.6.34-8.el8_4.2, libpng-devel-2:1.6.34-8.el8_4.2
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libpng-2:1.6.34-8.el8_4.2, libpng-devel-2:1.6.34-8.el8_4.2
  • RHSA-2026:4501 Released 2026-03-12 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:4306 Released 2026-03-11 · Red Hat rating Important
    mingw-libpng security update
    • Red Hat Enterprise Linux CRB (v. 8) mingw-libpng-1.6.34-2.el8_10, mingw32-libpng-1.6.34-2.el8_10, mingw32-libpng-static-1.6.34-2.el8_10 +2
  • RHSA-2026:4221 Released 2026-03-10 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng15-1.5.30-14.el9_2.1
  • RHSA-2026:4222 Released 2026-03-10 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libpng15-1.5.30-14.el9_0.1
  • RHSA-2026:3968 Released 2026-03-09 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng15-1.5.30-14.el9_6.1
  • RHSA-2026:3969 Released 2026-03-09 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpng15-1.5.30-14.el9_4.1
  • RHSA-2026:3577 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.2, libpng-devel-2:1.6.40-8.el10_0.2
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.2
  • RHSA-2026:3576 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng-2:1.6.37-12.el9_6.2, libpng-devel-2:1.6.37-12.el9_6.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libpng-2:1.6.37-12.el9_6.2
  • RHSA-2026:3574 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpng-2:1.6.37-12.el9_4.2, libpng-devel-2:1.6.37-12.el9_4.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libpng-2:1.6.37-12.el9_4.2
  • RHSA-2026:3575 Released 2026-03-03 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng-2:1.6.37-12.el9_2.2, libpng-devel-2:1.6.37-12.el9_2.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libpng-2:1.6.37-12.el9_2.2
  • RHSA-2026:3573 Released 2026-03-02 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libpng-2:1.6.37-12.el9_0.2, libpng-devel-2:1.6.37-12.el9_0.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libpng-2:1.6.37-12.el9_0.2
  • RHSA-2026:3551 Released 2026-03-02 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-8.el10_1.2, libpng-devel-2:1.6.40-8.el10_1.2
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-8.el10_1.2
  • RHSA-2026:3405 Released 2026-02-26 · Red Hat rating Important
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-12.el9_7.2, libpng-devel-2:1.6.37-12.el9_7.2
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-12.el9_7.2
  • RHSA-2026:3031 Released 2026-02-23 · Red Hat rating Important
    libpng15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng15-1.5.30-14.el9_7.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
OPENJDK ELS 11.0.31Fixed RHSA-2026:9255
Red Hat AI Inference Server 3.3Fixed RHSA-2026:16174, RHSA-2026:8746, RHSA-2026:8747, RHSA-2026:8748
Red Hat Build of OpenJDK 17.0.9Fixed RHSA-2026:9687
Red Hat Build of OpenJDK 21.0.11Fixed RHSA-2026:9690
Red Hat Build of OpenJDK 25.0.2Fixed—
Red Hat Build of OpenJDK 8u492Fixed RHSA-2026:9684
Red Hat Ceph Storage 8Fixed RHSA-2026:5606
Red Hat Discovery 2Fixed RHSA-2026:4501
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:3551
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:6439, RHSA-2026:6445
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:3031, RHSA-2026:3405
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:6466, RHSA-2026:7035
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:6467, RHSA-2026:7036
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:6469, RHSA-2026:7033
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:6469, RHSA-2026:7033
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:6468, RHSA-2026:7034
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:3573, RHSA-2026:4222
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:3575, RHSA-2026:4221
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:3577
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:3574, RHSA-2026:3969
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:3576, RHSA-2026:3968
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:6467, RHSA-2026:7036
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:6469, RHSA-2026:7033
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:6468, RHSA-2026:7034
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:3551
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:4728
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:3405
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:4732
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:4731
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:4729
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:3573
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:3575
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:3577
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:3574
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:3576
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:4731
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:4730
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:4729
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:4306
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:4756, RHSA-2026:7032
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:4756
Red Hat Hardened ImagesFixed RHSA-2026:6732, RHSA-2026:7503, RHSA-2026:80330
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:12274
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:7239
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:15087
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:14773
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:10097
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:17596
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:6553
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:7243
Not affected: 16 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • Red Hat Enterprise Linux AppStream E4S (v.8.6)
  • Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • Red Hat Enterprise Linux AppStream TUS (v.8.6)
  • Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • Red Hat Enterprise Linux Server (v. 7 ELS)
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • Red Hat build of OpenJDK 11 ELS

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25646
  2. 2026-10-08 EPSS moved to the 50th–90th percentile
  3. 2026-10-09 Fix available: RHSA-2026:9255 · Red Hat
  4. 2026-10-09 Fix available: OPENJDK ELS 11.0.31, Red Hat Build of OpenJDK 25.0.2 · Red Hat
  5. 2026-10-12 Fix available: RHSA-2026:80330 · Red Hat
  6. 2026-10-12 Affected versions changed · Red Hat
  7. 2026-10-16 Fix available: RHSA-2026:7503 · Red Hat
  8. 2026-10-16 Affected versions changed · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:9684 · Red Hat
  10. 2026-10-30 Fix available: RHSA-2026:9690 · Red Hat
  11. 2026-10-30 Fix available: Red Hat Build of OpenJDK 21.0.11, Red Hat Build of OpenJDK 8u492 · Red Hat
  12. 2026-10-31 Fix available: RHSA-2026:9687 · Red Hat
  13. 2026-10-31 Fix available: Red Hat Build of OpenJDK 17.0.9 · Red Hat

References

Exploit 1

Patch 1

  • TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
  • TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2025-40204 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` CVSS 3.1HIGH 7.1
  • TI-2025-40767 LIBPNG has an out-of-bounds read in png_image_read_composite CVSS 3.1HIGH 7.1
  • TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
  • TI-2025-20736 Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a… CVSS 3.1MEDIUM 5.5
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences