CVE-2025-64720: high-severity vulnerability in pnggroup libpng
LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Affected products
pnggroup · libpngRelated CVEs — pnggroup libpng
In the same product, most dangerous first.
CVE-2026-25646HIGHLIBPNG has a heap buffer overflow in png_set_quantizeEPSS 1.1%CVE-2026-33416HIGHLIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`EPSS 1.1%CVE-2026-33636HIGHLIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64EPSS 0.8%CVE-2025-66293HIGHLIBPNG has an out-of-bounds read in png_image_read_compositeEPSS 0.4%CVE-2025-65018HIGHLIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`EPSS 0.3%CVE-2026-22695MEDIUMLIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)EPSS 0.2%