CVE-2026-22695: falha de média gravidade em pnggroup libpng
LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.2%
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Produtos afetados
pnggroup · libpngCVEs relacionadas — pnggroup libpng
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25646HIGHLIBPNG has a heap buffer overflow in png_set_quantizeEPSS 1.1%CVE-2026-33416HIGHLIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`EPSS 1.1%CVE-2026-33636HIGHLIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64EPSS 0.8%CVE-2025-64720HIGHLIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplicationEPSS 0.4%CVE-2025-66293HIGHLIBPNG has an out-of-bounds read in png_image_read_compositeEPSS 0.4%CVE-2025-65018HIGHLIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`EPSS 0.3%