SUSE-SU-2026:20073-1

CVE-2025-64505: heap buffer over-read in png_do_quantize when processing PNG files malformed palette indices (bsc#1254157).
CVE-2025-64506: heap buffer over-read in png_write_image_8bit when processing 8-bit input with convert_to_8bit enabled (bsc#1254158).
CVE-2025-64720: out-of-bounds read in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled (bsc#1254159).
CVE-2025-65018: heap buffer overflow in png_image_finish_read when processing specially crafted 16-bit interlaced PNGs with 8-bit output format (bsc#1254160).
CVE-2025-66293: out-of-bounds read of the png_sRGB_base array when processing palette PNG images with partial transparency and gamma correction (bsc#1254480).

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.44-160000.3.1

{
    "binaries": [
        {
            "libpng16-16": "1.6.44-160000.3.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20073-1.json"