vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-64506

LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images

MEDIUM
6.1
CVSS Score
Published: November 24, 2025 at 11:41 PM UTC
Updated: October 18, 2026 at 08:10 PM UTC
2 products affected across 2 vendorsLibpngLibpng

Using libpng by pnggroup?

Get instant alerts when new vulnerabilities affect libpng - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.1
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Libpng· Libpng
95%
1.6.0 ≤ v < 1.6.51
Libpng· Pnggroup
90%
Affected range stops below 1.6.51, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

x_refsource_CONFIRMVendor Advisory
Source: cverecord
https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6
x_refsource_MISCIssue Tracking
Source: cverecord
https://github.com/pnggroup/libpng/pull/749
x_refsource_MISCPatch
Source: cverecord
https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.1MEDIUMGitHub_M
Attack Vector
LOCAL
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-125

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card