PT-2025-47831 · Libpng+9 · Libpng+9
Published
2025-05-26
·
Updated
2026-06-01
·
CVE-2025-64720
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:S/C:P/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libpng versions 1.6.0 through 1.6.50
libpng1.6 (affected versions not specified)
Description
The libpng PNG library contains a flaw that could lead to information leaks, denial of service, or potentially the execution of arbitrary code when processing specially crafted images. The issue is an out-of-bounds read vulnerability in the
png image read composite function when processing palette images with the PNG FLAG OPTIMIZE ALPHA flag enabled. The vulnerability stems from incorrect background compositing during premultiplication within the png init read transformations function, violating a required component invariant.Recommendations
Upgrade libpng1.6 packages to version 1.6.39-2+deb12u1 for Debian bookworm.
Upgrade libpng1.6 packages to version 1.6.48-1+deb13u1 for Debian trixie.
Upgrade libpng to version 1.6.51 or later.
Exploit
Fix
RCE
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Libpng
Linuxmint
Red Hat
Red Os
Rocky Linux
Ubuntu