Buffer overflow in Libpng

CVE-2026-25646

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Vulnerability class: Buffer Overflow

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.006 (48.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-25646: held from 0.010 to 0.006.

EPSS over last 30 days · oldest: 0.010 · newest: 0.006 · change: -0.003

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-25646?
CVE-2026-25646 is a high-severity vulnerability in Libpng, classified under Heap-based Buffer Overflow. CVSS score: 8.1/10. Published 2026-02-10.
How severe is CVE-2026-25646?
High severity. CVSS v3 base score is 8.1 out of 10.