The flaw is an integer truncation in the simplified write API functions png_write_image_16bit and png_write_image_8bit that permits a heap buffer over‑read when a negative row stride or a stride larger than 65535 bytes is supplied. This defect allows applications that link against libpng to read memory beyond the intended buffer boundaries, potentially leaking sensitive data. The vulnerability is classified under CWE‑125 (Buffer Over‑read) and CWE‑190 (Integer Overflow) due to the truncation of stride values during casting.

Library: libpng from the pnggroup organization. Versions 1.6.26 through 1.6.53 are affected; the problem was introduced in 1.6.26 and fixed in 1.6.54. Applications that invoke png_write_image_16bit or png_write_image_8bit with improper stride parameters run the risk of memory disclosure.

The CVSS base score of 6.8 indicates a moderate impact. EPSS is below 1%, suggesting a very low likelihood of exploitation in the near term, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, an attacker who controls image processing routines could supply a negative stride or an excessively large stride to trigger the over‑read, exposing arbitrary heap contents and compromising confidentiality of the host system or application.