CVE-2025-64720

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-64720
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643 Patch
https://github.com/pnggroup/libpng/issues/686 Exploit Issue Tracking
https://github.com/pnggroup/libpng/pull/751 Issue Tracking Patch
https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww Exploit Vendor Advisory
https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
History

26 Nov 2025, 18:35

Type Values Removed Values Added
CPE cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
First Time Libpng libpng
Libpng
References () https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643 - () https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643 - Patch
References () https://github.com/pnggroup/libpng/issues/686 - () https://github.com/pnggroup/libpng/issues/686 - Exploit, Issue Tracking
References () https://github.com/pnggroup/libpng/pull/751 - () https://github.com/pnggroup/libpng/pull/751 - Issue Tracking, Patch
References () https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww - () https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww - Exploit, Vendor Advisory

25 Nov 2025, 20:15

Type Values Removed Values Added
References () https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww - () https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww -

25 Nov 2025, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-25 00:15

Updated : 2025-11-26 18:35

NVD link : CVE-2025-64720

Mitre link : CVE-2025-64720

CVE.ORG link : CVE-2025-64720

JSON object : View

Products Affected

libpng

  • libpng
CWE
CWE-125

Out-of-bounds Read