CVE-2026-25646

Name	CVE-2026-25646
Description	LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4481-1, DSA-6138-1
Debian Bugs	1127566

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libpng1.6 (PTS)	bullseye	1.6.37-3	vulnerable
	bullseye (security)	1.6.37-3+deb11u2	fixed
	bookworm	1.6.39-2+deb12u1	vulnerable
	bookworm (security)	1.6.39-2+deb12u3	fixed
	trixie	1.6.48-1+deb13u1	vulnerable
	trixie (security)	1.6.48-1+deb13u3	fixed
	forky, sid	1.6.55-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libpng1.6	source	bullseye	1.6.37-3+deb11u2	DLA-4481-1
libpng1.6	source	bookworm	1.6.39-2+deb12u3	DSA-6138-1
libpng1.6	source	trixie	1.6.48-1+deb13u3	DSA-6138-1
libpng1.6	source	(unstable)	1.6.55-1		1127566

Notes

https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3
Fixed by: https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88 (v1.6.55)