pnggroup libpng
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-40930 | = 1.8.0 | LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-34757 | >= 1.0.9, < 1.6.57 | LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information… | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-33636 | >= 1.6.36, < 1.6.56 | LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 | HIGH 7.6 | 0.8 % | ||
| CVE-2026-33416 | >= 1.2.1, < 1.6.56 | LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` | HIGH 7.5 | 1.1 % | ||
| CVE-2026-3713 | 1.6.0 ; 1.6.1 ; 1.6.2 ; … | pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow | MEDIUM 4.8 | 0.1 % | ||
| CVE-2026-25646 | < 1.6.55 | LIBPNG has a heap buffer overflow in png_set_quantize | HIGH 8.3 | 1.1 % | ||
| CVE-2026-22801 | < 1.6.54 | LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_* | HIGH 7.8 | 0.1 % | ||
| CVE-2026-22695 | < 1.6.54 | LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix) | HIGH 7.1 | 0.2 % | ||
| CVE-2025-66293 | < 1.6.52 | LIBPNG has an out-of-bounds read in png_image_read_composite | HIGH 7.1 | 0.4 % | ||
| CVE-2025-65018 | >= 1.6.0, < 1.6.51 | LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` | HIGH 7.1 | 0.3 % | ||
| CVE-2025-64720 | >= 1.6.0, < 1.6.51 | LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication | HIGH 7.1 | 0.4 % | ||
| CVE-2025-64506 | >= 1.6.0, < 1.6.51 | LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images | MEDIUM 6.1 | 0.1 % | ||
| CVE-2025-64505 | < 1.6.51 | LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index | MEDIUM 6.1 | 0.2 % |