A flaw exists in libpng’s png_set_quantize function that triggers when the function is called with no histogram and the palette contains more than twice the maximum number of colors supported by the user’s display. Under these conditions a specific palette can make the routine enter an infinite loop that reads past the end of an internally heap‑allocated buffer. The vulnerability corresponds to memory corruption weaknesses CWE‑122, CWE‑125 and CWE‑126. The primary impact is an unbounded read of memory, which could allow an attacker to read sensitive data from the process after decoding a crafted PNG image, but it does not provide a direct code‑execution path. Additionally the infinite loop can lead to a denial‑of‑service condition for the host process.

The issue affects all libpng releases prior to version 1.6.55. Any application that processes PNG files through libpng before this version is potentially vulnerable. The affected product is the libpng library available from the official project repository, and the vulnerability is documented for all builds below 1.6.55, including those distributed as part of Linux distributions or other software stacks that bundle libpng.

The CVSS score of 8.3 classifies this as a high‑severity risk, and while the EPSS score is less than 1% indicating a low current exploitation probability, the flaw is not listed in the CISA KEV catalog. Attackers would need to supply a crafted PNG file that satisfies the specific palette condition to an application that loads images using libpng, which could be a local attacker or a remote user if the application accepts untrusted image input from the network. Given the lack of a direct execution vector, the threat is primarily information disclosure and potential denial of service in a local context.