https://seclists.org/oss-sec/2026/q1/57: libpng 1.6.54: two heap buffer over-ad vulnerabilities fixed: CVE-2026-22695, CVE-2026-22801
Published Jan 12, 2026
·Updated
Affected Software
1 affected component
libpng LIBPNG>=1.6.26<1.6.54, >=1.6.51<1.6.54
Frequently Asked Questions
1
What is the severity of CVE-2026-22695?
CVE-2026-22695 is classified as a medium-severity heap buffer over-read vulnerability.
2
How do I fix CVE-2026-22695?
To fix CVE-2026-22695, update to libpng version 1.6.54 or later.
3
What are the effects of CVE-2026-22695?
CVE-2026-22695 may allow attackers to read memory outside of the intended buffer during image processing.
4
What is the cause of CVE-2026-22695?
CVE-2026-22695 is caused by a regression from a previous fix for CVE-2025-65018 affecting the simplified API.
5
Is CVE-2026-22695 related to CVE-2026-22801?
Yes, both vulnerabilities are heap buffer over-read issues fixed in the same libpng release.