OESA-2025-2763 (CVE-2025-64505)

Vulnerability from osv_openeuler – Published: 2025-11-28 11:09 – Updated: 2026-08-06 11:09 – Source website
VLAI
Summary
libpng security update
Details

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.

Security Fix(es):

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libpng-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-devel-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-help-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-static-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-tools-1.6.40-2.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "libpng-1.6.40-2.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "libpng-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-devel-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-help-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-static-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-tools-1.6.40-2.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "libpng",
        "purl": "pkg:rpm/openEuler/libpng\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.40-2.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libpng-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-devel-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-help-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-static-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-tools-1.6.40-2.oe2403sp2.aarch64.rpm"
        ],
        "src": [
          "libpng-1.6.40-2.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "libpng-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-devel-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-help-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-static-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-tools-1.6.40-2.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "libpng",
        "purl": "pkg:rpm/openEuler/libpng\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.40-2.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libpng-1.6.37-2.oe2003sp4.aarch64.rpm",
          "libpng-debuginfo-1.6.37-2.oe2003sp4.aarch64.rpm",
          "libpng-debugsource-1.6.37-2.oe2003sp4.aarch64.rpm",
          "libpng-devel-1.6.37-2.oe2003sp4.aarch64.rpm",
          "libpng-help-1.6.37-2.oe2003sp4.aarch64.rpm"
        ],
        "src": [
          "libpng-1.6.37-2.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "libpng-1.6.37-2.oe2003sp4.x86_64.rpm",
          "libpng-debuginfo-1.6.37-2.oe2003sp4.x86_64.rpm",
          "libpng-debugsource-1.6.37-2.oe2003sp4.x86_64.rpm",
          "libpng-devel-1.6.37-2.oe2003sp4.x86_64.rpm",
          "libpng-help-1.6.37-2.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "libpng",
        "purl": "pkg:rpm/openEuler/libpng\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.37-2.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libpng-1.6.38-3.oe2203sp3.aarch64.rpm",
          "libpng-debuginfo-1.6.38-3.oe2203sp3.aarch64.rpm",
          "libpng-debugsource-1.6.38-3.oe2203sp3.aarch64.rpm",
          "libpng-devel-1.6.38-3.oe2203sp3.aarch64.rpm",
          "libpng-help-1.6.38-3.oe2203sp3.aarch64.rpm",
          "libpng-static-1.6.38-3.oe2203sp3.aarch64.rpm",
          "libpng-tools-1.6.38-3.oe2203sp3.aarch64.rpm"
        ],
        "src": [
          "libpng-1.6.38-3.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "libpng-1.6.38-3.oe2203sp3.x86_64.rpm",
          "libpng-debuginfo-1.6.38-3.oe2203sp3.x86_64.rpm",
          "libpng-debugsource-1.6.38-3.oe2203sp3.x86_64.rpm",
          "libpng-devel-1.6.38-3.oe2203sp3.x86_64.rpm",
          "libpng-help-1.6.38-3.oe2203sp3.x86_64.rpm",
          "libpng-static-1.6.38-3.oe2203sp3.x86_64.rpm",
          "libpng-tools-1.6.38-3.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "libpng",
        "purl": "pkg:rpm/openEuler/libpng\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.38-3.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libpng-1.6.38-3.oe2203sp4.aarch64.rpm",
          "libpng-debuginfo-1.6.38-3.oe2203sp4.aarch64.rpm",
          "libpng-debugsource-1.6.38-3.oe2203sp4.aarch64.rpm",
          "libpng-devel-1.6.38-3.oe2203sp4.aarch64.rpm",
          "libpng-help-1.6.38-3.oe2203sp4.aarch64.rpm",
          "libpng-static-1.6.38-3.oe2203sp4.aarch64.rpm",
          "libpng-tools-1.6.38-3.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "libpng-1.6.38-3.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "libpng-1.6.38-3.oe2203sp4.x86_64.rpm",
          "libpng-debuginfo-1.6.38-3.oe2203sp4.x86_64.rpm",
          "libpng-debugsource-1.6.38-3.oe2203sp4.x86_64.rpm",
          "libpng-devel-1.6.38-3.oe2203sp4.x86_64.rpm",
          "libpng-help-1.6.38-3.oe2203sp4.x86_64.rpm",
          "libpng-static-1.6.38-3.oe2203sp4.x86_64.rpm",
          "libpng-tools-1.6.38-3.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "libpng",
        "purl": "pkg:rpm/openEuler/libpng\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.38-3.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libpng-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-devel-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-help-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-static-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-tools-1.6.40-2.oe2403sp1.aarch64.rpm",
          "libpng-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-devel-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-help-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-static-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-tools-1.6.40-2.oe2403sp2.aarch64.rpm",
          "libpng-1.6.40-2.oe2403.aarch64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403.aarch64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403.aarch64.rpm",
          "libpng-devel-1.6.40-2.oe2403.aarch64.rpm",
          "libpng-help-1.6.40-2.oe2403.aarch64.rpm",
          "libpng-static-1.6.40-2.oe2403.aarch64.rpm",
          "libpng-tools-1.6.40-2.oe2403.aarch64.rpm"
        ],
        "src": [
          "libpng-1.6.40-2.oe2403sp1.src.rpm",
          "libpng-1.6.40-2.oe2403sp2.src.rpm",
          "libpng-1.6.40-2.oe2403.src.rpm"
        ],
        "x86_64": [
          "libpng-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-devel-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-help-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-static-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-tools-1.6.40-2.oe2403sp1.x86_64.rpm",
          "libpng-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-devel-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-help-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-static-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-tools-1.6.40-2.oe2403sp2.x86_64.rpm",
          "libpng-1.6.40-2.oe2403.x86_64.rpm",
          "libpng-debuginfo-1.6.40-2.oe2403.x86_64.rpm",
          "libpng-debugsource-1.6.40-2.oe2403.x86_64.rpm",
          "libpng-devel-1.6.40-2.oe2403.x86_64.rpm",
          "libpng-help-1.6.40-2.oe2403.x86_64.rpm",
          "libpng-static-1.6.40-2.oe2403.x86_64.rpm",
          "libpng-tools-1.6.40-2.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "libpng",
        "purl": "pkg:rpm/openEuler/libpng\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.40-2.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.\r\n\r\nSecurity Fix(es):\n\nLIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng\u0026apos;s png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)\n\nLIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng\u0026apos;s png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)\n\nLIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component \u2264 alpha \u00d7 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)\n\nLIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)",
  "id": "OESA-2025-2763",
  "modified": "2026-08-06T11:09:52Z",
  "published": "2025-11-28T11:09:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2763"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64505"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64506"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64720"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65018"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libpng security update",
  "upstream": [
    "CVE-2025-64505",
    "CVE-2025-64506",
    "CVE-2025-64720",
    "CVE-2025-65018"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.