CVE-2025-66293

Name	CVE-2025-66293
Description	LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1121877

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libpng1.6 (PTS)	bullseye	1.6.37-3	vulnerable
	bookworm	1.6.39-2	vulnerable
	trixie	1.6.48-1	vulnerable
	forky	1.6.51-1	vulnerable
	sid	1.6.52-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libpng1.6	source	(unstable)	1.6.52-1			1121877

Notes

https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f
Fixed by: https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1 (v1.6.52)
Fixed by: https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a (v1.6.52)