PT-2025-48996 · Libpng+9 · Libpng+9
Publicado
2025-12-03
·
Atualizado
2026-04-01
·
CVE-2025-66293
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libpng versions prior to 1.6.52
Description
LIBPNG is a library used for reading, creating, and manipulating PNG raster image files. A flaw exists in libpng's simplified API where processing valid palette PNG images with partial transparency and gamma correction can lead to an out-of-bounds read. Specifically, the
png sRGB base[512] array can be read beyond its bounds by up to 1012 bytes. The vulnerability occurs due to an issue in libpng's internal state management when handling these types of PNG images. The affected function is png image read composite. The PNG files that trigger this issue are valid according to the PNG specification.Recommendations
Upgrade to libpng version 1.6.52 or later.
Exploit
Correção
DoS
RCE
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Ubuntu
Libpng