CVE-2025-64720: LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in pngimagereadcomposite when processing palette images with PNGFLAGOPTIMIZEALPHA enabled. The palette compositing code in pnginitreadtransformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.
Other sources
LIBPNG is vulnerable to a buffer overflow in pngimagereadcomposite via incorrect palette premultiplication
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.51Patch CVE-2025-64505 - Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.51Patch CVE-2025-64506 - Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.51Patch CVE-2025-64720 - Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.51Patch CVE-2025-65018
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64720?
CVE-2025-64720 is classified as a medium severity vulnerability due to the potential for out-of-bounds reads.
How do I fix CVE-2025-64720?
To fix CVE-2025-64720, upgrade LIBPNG to version 1.6.51 or later.
What versions of LIBPNG are affected by CVE-2025-64720?
CVE-2025-64720 affects all LIBPNG versions from 1.6.0 to before 1.6.51.
What impact does CVE-2025-64720 have on applications using LIBPNG?
CVE-2025-64720 can lead to unexpected behavior or crashes in applications that process palette images.
Is CVE-2025-64720 a public vulnerability?
Yes, CVE-2025-64720 is a publicly disclosed vulnerability that has visibility within the cybersecurity community.