CVE-2025-65018

HIGH EPSS 12.9%
Published Nov 25, 20257mo ago · Modified Jun 17, 20261w ago
7.1 CVSS 3.1
High
Find Similar
Published Nov 25, 2025 7mo ago
Last Modified Jun 17, 2026 1w ago

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

CVSS Details

Base Score
7.1
Exploitability
1.8
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
12.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-122
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 1

VendorProductVersionRange
libpnglibpng*≥1.6.0  –  <1.6.51

References 5

  • github.com https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d
    Patch
  • github.com https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea
    Patch
  • github.com https://github.com/pnggroup/libpng/issues/755
    ExploitIssue Tracking
  • github.com https://github.com/pnggroup/libpng/pull/757
    Issue Tracking
  • github.com https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d
    Patch
  • github.com https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea
    Patch