CVE Explorer

CVE-2026-22801

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:daa3c036b04220b51200efe7f27c2ff0a76a1861c2ceaf1559f2efe3f7464181

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-125","description":"CWE-125: Out-of-bounds Read","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:1c7f59f6218611c4550b90d8f6ba0cc7ba69251da09a82147b59ea3c080591c8 · sha256:a53026040eeb0208… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-190","description":"CWE-190: Integer Overflow or Wraparound","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:1c7f59f6218611c4550b90d8f6ba0cc7ba69251da09a82147b59ea3c080591c8 · sha256:a53026040eeb0208… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion

{"product":"libpng","vendor":"pnggroup","versions":[{"status":"affected","version":"< 1.6.54"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1c7f59f6218611c4550b90d8f6ba0cc7ba69251da09a82147b59ea3c080591c8 · sha256:a53026040eeb0208… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:1c7f59f6218611c4550b90d8f6ba0cc7ba69251da09a82147b59ea3c080591c8 · sha256:a53026040eeb0208… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-125","description":"CWE-125: Out-of-bounds Read","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:1c7f59f6218611c4550b90d8f6ba0cc7ba69251da09a82147b59ea3c080591c8 · sha256:a53026040eeb0208… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-190","description":"CWE-190: Integer Overflow or Wraparound","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:1c7f59f6218611c4550b90d8f6ba0cc7ba69251da09a82147b59ea3c080591c8 · sha256:a53026040eeb0208… · /containers/cna/problemTypes/1/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8","tags":["x_refsource_CONFIRM"],"url":"https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1c7f59f6218611c4550b90d8f6ba0cc7ba69251da09a82147b59ea3c080591c8 · sha256:a53026040eeb0208… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer