CVE-2025-28164: libpng Buffer Overflow DoS Vulnerability

CVE-2025-28164 Overview

CVE-2025-28164 is a Buffer Overflow vulnerability affecting libpng versions 1.6.43 through 1.6.46. The vulnerability exists in the png_create_read_struct() function and allows a local attacker to cause a denial of service condition. This vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), which represents a classic buffer overflow scenario where input data exceeds the allocated buffer size.

Critical Impact

Local attackers can exploit this buffer overflow to crash applications that use affected libpng versions for PNG image processing, leading to denial of service conditions that impact system availability.

Affected Products

• libpng version 1.6.43
• libpng version 1.6.44
• libpng version 1.6.45
• libpng version 1.6.46

Discovery Timeline

• 2026-01-27 - CVE CVE-2025-28164 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-28164

Vulnerability Analysis

The vulnerability resides in the png_create_read_struct() function within libpng, a widely-used open-source library for reading, creating, and manipulating PNG image files. Buffer overflow vulnerabilities in image processing libraries are particularly concerning because PNG images are ubiquitous across web applications, desktop software, and embedded systems.

When processing specially crafted input, the vulnerable function fails to properly validate the size of input data before copying it into a fixed-size buffer. This can result in memory corruption that causes the application to crash. While the current assessment indicates the vulnerability leads to denial of service, buffer overflows can sometimes be leveraged for more severe attacks depending on the specific memory layout and protections in place.

The local attack vector means that an attacker would need some level of access to the target system or the ability to provide malicious PNG files to local applications for processing. Applications that automatically process PNG files from untrusted sources are at higher risk.

Root Cause

The root cause of CVE-2025-28164 is a classic buffer overflow condition (CWE-120) in the png_create_read_struct() function. The function does not adequately check the size of input data before copying it into an internal buffer, allowing data to overflow beyond the allocated memory boundaries. This lack of bounds checking is a fundamental memory safety issue that can lead to stack or heap corruption depending on how the buffer is allocated.

Attack Vector

The attack vector is local, requiring the attacker to either have direct access to the target system or the ability to supply a malicious PNG file to an application that processes it locally. The attack scenario typically involves:

1. An attacker crafts a malicious PNG file designed to trigger the buffer overflow in png_create_read_struct()
2. The victim application processes the malicious PNG file
3. The buffer overflow causes memory corruption, leading to application crash and denial of service

The vulnerability requires low privileges to exploit and does not require user interaction, making it relatively straightforward for an attacker with local access to trigger the condition. Technical details and proof-of-concept information are available in the GitHub Issue for libpng and the GitHub Gist PoC Analysis.

Detection Methods for CVE-2025-28164

Indicators of Compromise

• Application crashes or unexpected termination when processing PNG files
• Core dumps or crash reports indicating memory corruption in libpng functions
• Increased system instability in services that process PNG images
• Stack traces or error logs referencing png_create_read_struct() or related libpng functions

Detection Strategies

• Monitor application logs for crashes related to PNG processing or libpng library calls
• Implement memory corruption detection tools such as AddressSanitizer (ASan) in development and testing environments
• Use file integrity monitoring to detect unusual PNG files being introduced to the system
• Deploy endpoint detection solutions capable of identifying buffer overflow exploitation attempts

Monitoring Recommendations

• Enable crash reporting and analysis for applications that use libpng for image processing
• Set up alerts for unusual patterns of application restarts or service failures
• Monitor system memory usage patterns for anomalies that may indicate exploitation attempts
• Review logs from web servers and image processing services for repeated failures when handling specific files

How to Mitigate CVE-2025-28164

Immediate Actions Required

• Inventory all systems and applications using libpng versions 1.6.43 through 1.6.46
• Prioritize patching systems that process PNG files from untrusted or external sources
• Consider temporarily disabling PNG processing functionality in critical systems until patches can be applied
• Implement input validation to reject malformed or suspicious PNG files before processing

Patch Information

Organizations should monitor the official libpng project for security updates addressing this vulnerability. Refer to the GitHub Issue for libpng for the latest information on patch availability and remediation guidance. Update to a patched version of libpng as soon as one becomes available from the maintainers.

Workarounds

• Restrict access to systems that process PNG files to trusted users only
• Implement strict input validation on PNG files before passing them to libpng for processing
• Consider using alternative image processing libraries for PNG handling until a patch is available
• Deploy application sandboxing to limit the impact of potential crashes or exploitation

# Check installed libpng version on Linux systems
pkg-config --modversion libpng
# Or check the library directly
ldconfig -p | grep libpng

# If vulnerable version detected (1.6.43-1.6.46), prioritize update
# Example: Update libpng on Debian/Ubuntu
sudo apt update && sudo apt upgrade libpng16-16