CVE-2025-65018

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d	Patch
https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea	Patch
https://github.com/pnggroup/libpng/issues/755	Exploit Issue Tracking
https://github.com/pnggroup/libpng/pull/757	Issue Tracking
https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g	Exploit Vendor Advisory
https://github.com/pnggroup/libpng/issues/755	Exploit Issue Tracking
https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) LIBPNG es una biblioteca de referencia para su uso en aplicaciones que leen, crean y manipulan archivos de imagen ráster PNG (Portable Network Graphics). Desde la versión 1.6.0 hasta la 1.6.51, existe una vulnerabilidad de desbordamiento de búfer de montón en la función API simplificada de libpng 'png_image_finish_read' al procesar PNGs entrelazados de 16 bits con formato de salida de 8 bits. Archivos PNG entrelazados creados por el atacante causan escrituras en el montón más allá de los límites del búfer asignado. Este problema ha sido parcheado en la versión 1.6.51.

Information

Published : 2025-11-25 00:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-65018

Mitre link : CVE-2025-65018

CVE.ORG link : CVE-2025-65018

JSON object : View

Products Affected

libpng

libpng

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-65018", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65018", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-25T19:29:28.950712Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pnggroup", "product": "libpng", "versions": [{"status": "affected", "version": ">= 1.6.0, < 1.6.51"}]}]}], "published": "2025-11-25T00:15:47.610", "references": [{"url": "https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pnggroup/libpng/issues/755", "tags": ["Exploit", "Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pnggroup/libpng/pull/757", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pnggroup/libpng/issues/755", "tags": ["Exploit", "Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51."}, {"lang": "es", "value": "LIBPNG es una biblioteca de referencia para su uso en aplicaciones que leen, crean y manipulan archivos de imagen r\u00e1ster PNG (Portable Network Graphics). Desde la versi\u00f3n 1.6.0 hasta la 1.6.51, existe una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n en la funci\u00f3n API simplificada de libpng 'png_image_finish_read' al procesar PNGs entrelazados de 16 bits con formato de salida de 8 bits. Archivos PNG entrelazados creados por el atacante causan escrituras en el mont\u00f3n m\u00e1s all\u00e1 de los l\u00edmites del b\u00fafer asignado. Este problema ha sido parcheado en la versi\u00f3n 1.6.51."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3545FEA5-4FFA-4955-BFDA-CC3602C9A894", "versionEndExcluding": "1.6.51", "versionStartIncluding": "1.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}