Heap Buffer Over-read in LIBPNG Affects Image Processing

CVE-2026-22695

What is CVE-2026-22695?

LIBPNG, a reference library used for handling PNG image files, has a vulnerability that allows for a heap buffer over-read in the simplified API function png_image_finish_read. This issue arises when dealing with interlaced 16-bit PNGs while outputting in an 8-bit format and utilizing a non-minimal row stride. This regression was introduced following a fix implemented for a prior vulnerability. The issue can adversely affect applications that rely on LIBPNG for image manipulation, underscoring the need for users to update to version 1.6.54 or later to ensure security and functionality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References