CVE-2026-22801: falha de média gravidade em pnggroup libpng
LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.1%
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Produtos afetados
pnggroup · libpngCVEs relacionadas — pnggroup libpng
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25646HIGHLIBPNG has a heap buffer overflow in png_set_quantizeEPSS 1.1%CVE-2026-33416HIGHLIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`EPSS 1.1%CVE-2026-33636HIGHLIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64EPSS 0.8%CVE-2025-64720HIGHLIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplicationEPSS 0.4%CVE-2025-66293HIGHLIBPNG has an out-of-bounds read in png_image_read_compositeEPSS 0.4%CVE-2025-65018HIGHLIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`EPSS 0.3%