CVE-2026-25646 Details

A heap buffer overflow vulnerability has been identified in libpng versions prior to 1.6.55, specifically within the low-level png_set_quantize() API function. This vulnerability arises when the function is called without a histogram and the palette size exceeds twice the maximum colors supported by the user's display. Under these conditions, certain palettes can cause the function to enter an infinite loop, reading past the end of a heap-allocated buffer. The vulnerability has existed since the function's introduction, under the name png_set_dither(). Exploitation can lead to a denial-of-service condition, causing a crash, or potentially allow for information disclosure or arbitrary code execution through heap corruption.

Users are advised to upgrade to libpng version 1.6.55, which addresses the vulnerability by correcting the logic in the png_set_quantize() function to prevent out-of-bounds reads.