LibPNG 1.6.55-Pre: OOB Read in png_set_quantize() w/ no hist leads to infinite loop
CVE-2026-25646 Published on February 10, 2026
LIBPNG has a heap buffer overflow in png_set_quantize
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.
Vulnerability Analysis
CVE-2026-25646 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-25646. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and a high impact on availability.
Weakness Types
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Buffer Over-read
The software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This typically occurs when the pointer or its index is incremented to a position beyond the bounds of the buffer or when pointer arithmetic results in a position outside of the valid memory location to name a few. This may result in exposure of sensitive information or possibly a crash.
Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. A crash can occur when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent read operation then produces undefined or unexpected results.
Products Associated with CVE-2026-25646
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-25646 are published in these products:
Affected Versions
pnggroup libpng:- Version < 1.6.55 is affected.
- Version openjdk-portable and below * is unaffected.
- Version openjdk-portable and below * is unaffected.
- Version 2:1.6.40-8.el10_1.2 and below * is unaffected.
- Version 1:21.0.11.0.10-2.el10_2 and below * is unaffected.
- Version 2:1.6.40-8.el10_0.2 and below * is unaffected.
- Version 1:21.0.11.0.10-1.el10_2 and below * is unaffected.
- Version 2:1.5.13-8.el7_9.2 and below * is unaffected.
- Version 0:1.2.50-10.el7_9.1 and below * is unaffected.
- Version 0:1.5.30-8.el8_10 and below * is unaffected.
- Version 0:1.2.57-6.el8_10 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el8 and below * is unaffected.
- Version 1:21.0.11.0.10-1.el8 and below * is unaffected.
- Version 0:1.6.34-2.el8_10 and below * is unaffected.
- Version 2:1.6.34-10.el8_10 and below * is unaffected.
- Version 0:1.5.30-7.el8_2.1 and below * is unaffected.
- Version 0:1.2.57-5.el8_2.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 2:1.6.34-8.el8_2.2 and below * is unaffected.
- Version 0:1.5.30-7.el8_4.1 and below * is unaffected.
- Version 0:1.2.57-5.el8_4.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el8 and below * is unaffected.
- Version 2:1.6.34-8.el8_4.2 and below * is unaffected.
- Version 0:1.5.30-7.el8_4.1 and below * is unaffected.
- Version 0:1.2.57-5.el8_4.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el8 and below * is unaffected.
- Version 2:1.6.34-8.el8_4.2 and below * is unaffected.
- Version 0:1.5.30-7.el8_6.1 and below * is unaffected.
- Version 0:1.2.57-5.el8_6.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el8 and below * is unaffected.
- Version 2:1.6.34-8.el8_6.2 and below * is unaffected.
- Version 0:1.5.30-7.el8_6.1 and below * is unaffected.
- Version 0:1.2.57-5.el8_6.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el8 and below * is unaffected.
- Version 2:1.6.34-8.el8_6.2 and below * is unaffected.
- Version 0:1.5.30-7.el8_6.1 and below * is unaffected.
- Version 0:1.2.57-5.el8_6.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el8 and below * is unaffected.
- Version 2:1.6.34-8.el8_6.2 and below * is unaffected.
- Version 0:1.5.30-7.el8_8.1 and below * is unaffected.
- Version 0:1.2.57-5.el8_8.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el8 and below * is unaffected.
- Version 2:1.6.34-8.el8_8.2 and below * is unaffected.
- Version 0:1.5.30-7.el8_8.1 and below * is unaffected.
- Version 0:1.2.57-5.el8_8.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el8 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el8 and below * is unaffected.
- Version 2:1.6.34-8.el8_8.2 and below * is unaffected.
- Version 0:1.5.30-14.el9_7.1 and below * is unaffected.
- Version 2:1.6.37-12.el9_7.2 and below * is unaffected.
- Version 1:1.8.0.492.b09-2.el9 and below * is unaffected.
- Version 1:17.0.19.0.10-2.el9 and below * is unaffected.
- Version 1:21.0.11.0.10-2.el9 and below * is unaffected.
- Version 2:1.6.37-12.el9_0.2 and below * is unaffected.
- Version 0:1.5.30-14.el9_0.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el9 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el9 and below * is unaffected.
- Version 2:1.6.37-12.el9_2.2 and below * is unaffected.
- Version 0:1.5.30-14.el9_2.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el9 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el9 and below * is unaffected.
- Version 2:1.6.37-12.el9_4.2 and below * is unaffected.
- Version 0:1.5.30-14.el9_4.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el9 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el9 and below * is unaffected.
- Version 1:21.0.11.0.10-1.el9 and below * is unaffected.
- Version 2:1.6.37-12.el9_6.2 and below * is unaffected.
- Version 0:1.5.30-14.el9_6.1 and below * is unaffected.
- Version 1:1.8.0.492.b09-1.el9 and below * is unaffected.
- Version 1:17.0.19.0.10-1.el9 and below * is unaffected.
- Version 1:21.0.11.0.10-1.el9 and below * is unaffected.
- Version 1:11.0.31.0.11-1.el7_9 and below * is unaffected.
- Version 1:11.0.31.0.11-1.el8 and below * is unaffected.
- Version 1:11.0.31.0.11-1.el9 and below * is unaffected.
- Version 412.86.202604281506-0 and below * is unaffected.
- Version 413.92.202604080111-0 and below * is unaffected.
- Version 414.92.202605060243-0 and below * is unaffected.
- Version 415.92.202605060220-0 and below * is unaffected.
- Version 416.94.202604211449-0 and below * is unaffected.
- Version 417.94.202605112123-0 and below * is unaffected.
- Version 418.94.202603261158-0 and below * is unaffected.
- Version 4.19.9.6.202604080618-0 and below * is unaffected.
- Version 1778244546 and below * is unaffected.
- Version 1775680192 and below * is unaffected.
- Version 1775680262 and below * is unaffected.
- Version 1775749857 and below * is unaffected.
- Version 1774002867 and below * is unaffected.
- Version 1773273070 and below * is unaffected.
- Version 1.6.56-1.hum1 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.