SB2026081268 - SUSE update for libpng16
Published: August 12, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Memory leak (CVE-ID: CVE-2025-28162)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in png_malloc_base() function. A remote attacker can supply a specially crafted image file to the application and force the library to leak memory.
2) Out-of-bounds read (CVE-ID: CVE-2025-64505)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the png_do_quantize function when processing PNG files with malformed palette indices. A remote attacker can pass a specially crafted image file to the application, trigger an out-of-bounds read error and read contents of memory on the system.
3) Out-of-bounds read (CVE-ID: CVE-2025-64506)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the png_write_image_8bit() function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. A remote attacker can pass a specially crafted image file to the application, trigger an out-of-bounds read error and read contents of memory on the system.
4) Out-of-bounds read (CVE-ID: CVE-2025-64720)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the png_image_read_composite() function when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. A remote attacker can pass a specially crafted image file to the application, trigger an out-of-bounds read error and read contents of memory on the system.
5) Heap-based buffer overflow (CVE-ID: CVE-2025-65018)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the png_image_finish_read() function when processing 16-bit interlaced PNGs with 8-bit output format. A remote attacker can pass a specially crafted image file to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Out-of-bounds read (CVE-ID: CVE-2025-66293)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the png_image_read_composite() function. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
7) Out-of-bounds read (CVE-ID: CVE-2026-22695)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information or crash the application.
The vulnerability exists due to a boundary condition within the png_image_finish_read() function when reading 16-bit PNG images with 8-bit output format and non-minimal row stride. A remote attacker can supply a specially crafted PNG image file to the application, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
Note, the vulnerability exists due to an incomplete fix for #VU118777 (CVE-2025-65018).
8) Out-of-bounds read (CVE-ID: CVE-2026-22801)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information or crash the application.
The vulnerability exists due to integer truncation within the png_write_image_16bit() and png_write_image_8bit() functions. A remote attacker can supply a specially crafted PNG file to the application, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
9) Heap-based buffer overflow (CVE-ID: CVE-2026-25646)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the png_set_quantize() API function. A remote attacker can pass specially crafted PNG image to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Use-after-free (CVE-ID: CVE-2026-33416)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in png_set_tRNS and png_set_PLTE when processing a crafted PNG file and subsequent decoding after png_free_data() or repeated setter calls. A remote attacker can supply a specially crafted PNG file to execute arbitrary code.
User interaction is required to open or process the crafted PNG file, and exploitation affects applications that free PNG data between png_read_info() and png_read_update_info().
11) Out-of-bounds read (CVE-ID: CVE-2026-33636)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service, disclose sensitive information, and corrupt memory.
The vulnerability exists due to out-of-bounds read and out-of-bounds write in the ARM/AArch64 Neon palette expansion path when decoding a crafted paletted PNG image with palette expansion enabled. A remote attacker can supply a specially crafted PNG image to cause a denial of service, disclose sensitive information, and corrupt memory.
Only builds targeting ARM/AArch64 with Neon enabled are affected. The issue is triggered for palette-based images during palette expansion, with the RGBA path requiring a tRNS chunk and the RGB path requiring no tRNS chunk. User interaction is required to open or process the crafted image.
12) Use-after-free (CVE-ID: CVE-2026-34757)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose heap information and corrupt chunk data.
The vulnerability exists due to use-after-free in png_set_PLTE, png_set_tRNS, and png_set_hIST when passing a pointer returned by the corresponding getter back into the setter on the same png_struct/png_info pair. A remote attacker can pass an aliased pointer to cause the library to read freed memory and copy stale or unrelated heap contents into replacement storage to disclose heap information and corrupt chunk data.
The issue cannot be triggered by a crafted PNG file alone; exploitation requires the application to call the getter and setter in sequence on the same struct pair, and any image containing the relevant chunk is sufficient to set up the internal pointer.
Remediation
Install update from vendor's website.