PT-2025-47829 · Libpng+7 · Libpng+7
Published
2025-05-26
·
Updated
2026-06-01
·
CVE-2025-64505
CVSS v3.1
6.1
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libpng versions prior to 1.6.51
libpng1.6 versions prior to 1.6.39-2+deb12u1
libpng1.6 versions prior to 1.6.48-1+deb13u1
libpng12-0 versions prior to 1.6.52-alt1
Description
LIBPNG is a library used for reading, creating, and manipulating PNG (Portable Network Graphics) raster image files. A heap buffer over-read issue exists in the
png do quantize function when processing PNG files containing malformed palette indices. This occurs because the palette lookup array bounds are not validated against externally supplied image data. An attacker can craft a PNG file with out-of-range palette indices, leading to out-of-bounds memory access.Recommendations
Upgrade to libpng version 1.6.51 or later.
Upgrade to libpng1.6 version 1.6.39-2+deb12u1 or later.
Upgrade to libpng1.6 version 1.6.48-1+deb13u1 or later.
Upgrade to libpng12-0 version 1.6.52-alt1 or later.
Exploit
Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Libpng
Linuxmint
Apple Macos
Red Os
Suse
Ubuntu