CVE-2025-66293: LIBPNG has an out-of-bounds read in png_image_read_composite
LIBPNG has an out-of-bounds read in pngimagereadcomposite
Other sources
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the pngsRGBbase[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.52 - Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.52Patch CVE-2025-66293
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66293?
CVE-2025-66293 is categorized as a security vulnerability that allows an out-of-bounds read, potentially leading to information disclosure.
How do I fix CVE-2025-66293?
To address CVE-2025-66293, update libpng to version 1.6.52 or later, where the vulnerability has been patched.
What types of systems are affected by CVE-2025-66293?
CVE-2025-66293 affects applications that utilize libpng versions prior to 1.6.52 for processing PNG image files.
Can CVE-2025-66293 lead to further exploitation?
While CVE-2025-66293 primarily involves an out-of-bounds read, it could potentially be leveraged for more complex attacks based on the context of use.
Is there a workaround for CVE-2025-66293 until I can update?
There are no known workarounds for CVE-2025-66293, so upgrading to the patched version is the recommended solution.