PT-2026-4944 · Libpng+3 · Libpng+3

Published 2025-01-01 · Updated 2026-04-14 · CVE-2025-28162

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libpng versions 1.6.43 through 1.6.46

Description A buffer overflow issue exists in libpng versions 1.6.43 through 1.6.46. A local attacker can potentially cause a denial of service by exploiting the vulnerability through a specially crafted pngimage. When AddressSanitizer (ASan) is enabled, the program may leak memory in multiple locations, resulting in increased memory usage and potentially causing the program to become unresponsive.

Recommendations Update libpng to a version later than 1.6.46.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2026-05685

CVE-2025-28162

ECHO-6086-BF4F-3673

OESA-2026-1313

OESA-2026-1314

OESA-2026-1315

OESA-2026-1316

OPENSUSE-SU-2026:20378-1

RHSA-2026:6732

SUSE-SU-2026:0364-1

SUSE-SU-2026:0596-1

SUSE-SU-2026:20523-1

SUSE-SU-2026:20530-1

SUSE-SU-2026:20750-1

USN-7993-1

Affected Products

Linuxmint

Red Os

Ubuntu

Libpng

References · 57

• 🔥 https://github.com/pnggroup/libpng/issues/656 · Exploit
• https://osv.dev/vulnerability/OESA-2026-1314 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-28162 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-28164 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2025-28162 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-28162 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-28162 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-28162 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-28162 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-28162 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05685 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20523-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0596-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-28162 · Vendor Advisory