CVE-2026-22695

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22695
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22695.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22695
Aliases
  • GHSA-mmq5-27w3-rxpp
Downstream
Related
Published
2026-01-12T22:55:40.204Z
Modified
2026-07-15T17:53:51.081399Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator
Summary
LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)
Details

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function pngimagefinish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.

Database specific 
{
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22695.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/pnggroup/libpng

Affected ranges

Type
GIT
Repo
https://github.com/pnggroup/libpng
Events
Introduced
49363adcfaf098748d7a4c8c624ad8c45a8c3a86
Fixed
02f2b4f4699f0ef9111a6534f093b53732df4452
Fixed
218612ddd6b17944e21eda56caf8b4bf7779d1ea
Fixed
e4f7ad4ea2
Database specific 
{
    "cpe": "cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.6.51"
        },
        {
            "fixed": "1.6.54"
        }
    ]
}

Affected versions

v1.*
v1.6.51
v1.6.52
v1.6.53

Database specific

vanir_signatures_modified 
"2026-07-15T17:53:51Z"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "target": {
            "file": "png.c"
        },
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "id": "CVE-2026-22695-010f10be",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "327333362595809855009709216293242458091",
                "279773453140246214690474345717570130546",
                "115820707951216701988175577087939699096",
                "311171675743028020374147954611376107950",
                "167668607726485798520722745583647935882",
                "334738595734899256725134661017463305676"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "pngread.c",
            "function": "png_image_finish_read"
        },
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
        "id": "CVE-2026-22695-09462e07",
        "signature_version": "v1",
        "digest": {
            "function_hash": "152089211188261457050061368992955969886",
            "length": 2018.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "png.c",
            "function": "png_get_copyright"
        },
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "id": "CVE-2026-22695-13e3a59d",
        "signature_version": "v1",
        "digest": {
            "function_hash": "154053324026357579622821123918096375308",
            "length": 481.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "pngread.c",
            "function": "png_image_read_direct"
        },
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
        "id": "CVE-2026-22695-2ef624d2",
        "signature_version": "v1",
        "digest": {
            "function_hash": "2333317633844082296990629291887699048",
            "length": 5430.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "png.h"
        },
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "id": "CVE-2026-22695-3d373722",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "166375070723291529406421301066248769034",
                "275647010778297936193963675511576832388",
                "256826767335212246520616614652191899280",
                "279336807821086835335477021495116274772",
                "21410732896831932727182998172814220178",
                "106550426482539417114549859700126206902",
                "247197528077876204962072745179511874496",
                "327509478853766906744281300346084898016"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "pngtest.c"
        },
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "id": "CVE-2026-22695-5469271d",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "61817495566730883906655567599472824457",
                "275257476952071577898258900499903171964",
                "91397839701035180686538087820368727519",
                "158625912433874676602721644606842363619"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "pngread.c"
        },
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
        "id": "CVE-2026-22695-7c05293a",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "256497911793156591007313981010137330804",
                "109584513501258957054077128149474560042",
                "192237975258510526477257404003263997624",
                "30606990160421519100275116613142310139",
                "312156519594095370516028297434459873770",
                "220900142416162017220967854775361553404",
                "36118662072103505342061490674230260058",
                "168790125413818935852173291986961269893",
                "120761265379115761546610377133230135172",
                "189089162184373099497428494853543124429",
                "106750596262754699567758987243416013094",
                "226689034820418758914997172041229489211",
                "97224864048706724588862181400610346559",
                "266456732266638609151505188293053155290",
                "203027305669929221271641817633434951738",
                "242739659333768501417776094650324945646",
                "2565877639064083502211329144054449282",
                "334449031200425985162851821346368123662",
                "330775475673055302350346660593795397359",
                "176240222955364160527702469812611380358",
                "11943884251452331759710291842286533529",
                "213920974765294708682054244944584079400",
                "282420276832768553133997784203669148659",
                "328082467098480595943018613690952846180",
                "85407131502103425500873655207900827151",
                "327491415051830615961273482749990703128",
                "215823029670091642558595124854797180422",
                "1689536822304807430628861611239673510",
                "76383076396192905111578340454310377134",
                "262631843307366329793905998192121463093"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22695.json"