LIBPNG has a heap buffer over-read in the simplified API function png_image_finish_read. The issue is triggered when processing interlaced 16‑bit PNG files that are requested in an 8‑bit output format and have a non‑minimal row stride. Because the read extends beyond the intended boundary, memory containing unrelated data may be exposed, potentially revealing sensitive information stored on the heap. The flaw is a regression that was introduced by the fix for a previous vulnerability and is fixed in a later release.

The libpng library distributed by the PNG Group is affected. Versions 1.6.51 through 1.6.53 contain the regression. The vulnerability is resolved in version 1.6.54 and later.

The CVSS score of 6.1 indicates moderate severity while the EPSS score of less than 1% signals a very low current exploitation probability. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the over‑read occurs during image processing, an attacker would require the ability to supply crafted PNG files to an application that uses the unpatched libpng. If an application accepts images from untrusted sources, the risk could be viewed as a local or remote information‑disclosure threat depending on the context.