Bug 2418711 (CVE-2025-66293)

Summary: CVE-2025-66293 libpng: LIBPNG out-of-bounds read in png_image_read_composite
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: adudiak, ahughes, caswilli, fferrari, fitzsim, gotiwari, jgrulich, jhorak, kaycoth, khosford, kshier, mvyas, neugens, pjindal, stcannon, tpopela, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An out of bounds read vulnerability has been discovered in libpng. This vulnerability is in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2418723, 2418724, 2418725, 2418726, 2418727, 2418728, 2418729, 2418730, 2418731, 2418732, 2418733, 2418734, 2418735, 2418736, 2418739, 2418740, 2418741, 2418742, 2418743, 2418744, 2418745, 2418746, 2418747, 2418750, 2418751, 2418737, 2418738, 2418748, 2418749    
Bug Blocks:    

Description OSIDB Bzimport 2025-12-03 21:01:34 UTC
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.