LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's pngwriteimage8bit function when processing 8-bit images through the simplified write API with convertto_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.
{
"cwe_ids": [
"CWE-125"
]
}[
{
"id": "CVE-2025-64506-1ff2fa39",
"target": {
"file": "png.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"166375070723291529406421301066248769034",
"275647010778297936193963675511576832388",
"256826767335212246520616614652191899280",
"279336807821086835335477021495116274772",
"289998086382119027680343151146219735692",
"127562272222925286109814353033687270978",
"25813353444574047506367402039418644046",
"253582453789718568595455958296774742498"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86",
"signature_version": "v1"
},
{
"id": "CVE-2025-64506-485b33da",
"target": {
"file": "png.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"156580915294223224015440899088615326697",
"218405736567565762721805663647781263162",
"85662020663482796805838288188511316315",
"230686006833406113235008350425423979914",
"260919417129355689179955630465652050316",
"95506800799202743812829450076592490423"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86",
"signature_version": "v1"
},
{
"id": "CVE-2025-64506-a8777218",
"target": {
"file": "png.c",
"function": "png_get_copyright"
},
"digest": {
"length": 481.0,
"function_hash": "308839484675692000161271595223156832928"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86",
"signature_version": "v1"
},
{
"id": "CVE-2025-64506-e1a15be6",
"target": {
"file": "pngtest.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"52540900908244694562855646578057113774",
"200219053898519147474761570586990540810",
"23871324486584156747326023564743243101",
"63048311541359152088830007041723625585"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86",
"signature_version": "v1"
}
]
[
{
"id": "CVE-2025-64506-2c65d53c",
"target": {
"file": "pngwrite.c",
"function": "png_image_write_main"
},
"digest": {
"length": 4091.0,
"function_hash": "287482560906552393873723524112952439303"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821",
"signature_version": "v1"
},
{
"id": "CVE-2025-64506-aed5ccf8",
"target": {
"file": "pngwrite.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"275045913931547721476341089800703559241",
"57554663865845067308084737628464609765",
"212985072000760523111093531678898379495",
"81688707855809561231911606613238509787",
"57631009309811357417734919908001123984"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821",
"signature_version": "v1"
}
]