LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
pnggroup libpng affected
Version Status Constraints
< 1.6.55 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Pnggroup Subscribe
Libpng Subscribe

Project Subscriptions

Vendors Products
Pnggroup Subscribe
Libpng Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://www.openwall.com/lists/oss-security/2026/02/09/7 cve-icon cve-icon
https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88 cve-icon cve-icon cve-icon
https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-25646 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-25646 cve-icon
History

Wed, 11 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

threat_severity

Important

Tue, 10 Feb 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Pnggroup
Pnggroup libpng
Vendors & Products Pnggroup
Pnggroup libpng

Tue, 10 Feb 2026 18:30:00 +0000

Type Values Removed Values Added
References

Tue, 10 Feb 2026 17:30:00 +0000

Type Values Removed Values Added
Description LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.
Title LIBPNG has a heap buffer overflow in png_set_quantize
Weaknesses CWE-122
CWE-126
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-02-10T17:25:31.583Z

Reserved: 2026-02-04T05:15:41.791Z

Link: CVE-2026-25646

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-02-10T18:16:37.817

Modified: 2026-02-10T21:51:48.077

Link: CVE-2026-25646

cve-icon Redhat

Severity : Important

Publid Date: 2026-02-10T17:04:38Z

Links: CVE-2026-25646 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-02-10T21:41:59Z

Weaknesses