CVE-2025-64505: Libpng Buffer Overflow Vulnerability

CVE-2025-64505 Overview

CVE-2025-64505 is a heap buffer over-read vulnerability in libpng, the reference library for reading, creating, and manipulating PNG (Portable Network Graphics) raster image files. Versions prior to 1.6.51 fail to validate palette_lookup array bounds against externally-supplied image data. An attacker who crafts a PNG file with out-of-range palette indices can trigger out-of-bounds memory access inside the png_do_quantize function. The issue was patched in libpng version 1.6.51.

Critical Impact
A malicious PNG file can cause applications linked against vulnerable libpng builds to crash or leak adjacent heap memory when quantization is enabled during image decoding.

Affected Products

libpng versions prior to 1.6.51
Applications that link libpng and invoke palette quantization during PNG decoding
Downstream software distributions bundling vulnerable libpng builds

Discovery Timeline

2025-11-25 - CVE-2025-64505 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64505

Vulnerability Analysis

The vulnerability is a heap out-of-bounds read [CWE-125] inside png_do_quantize in pngrtran.c. When libpng processes a PNG using palette quantization, it allocates quantize_index sized to num_palette entries. The palette_lookup table, however, can be indexed using values derived from attacker-controlled image data. If those indices exceed num_palette, libpng reads memory past the end of the allocated buffer.

Exploitation requires the victim to open a crafted PNG file in an application that uses libpng's quantization path. Successful triggering results in adjacent heap memory being read, which can crash the process or, in some contexts, expose sensitive in-process data through side channels.

Root Cause

The root cause is missing validation of externally-supplied palette indices against the fixed maximum palette length (PNG_MAX_PALETTE_LENGTH, 256). The allocation for quantize_index was tied to num_palette from the file, while lookups could reference indices beyond that value. Malformed PNGs with out-of-range palette indices therefore read outside the allocated region.

Attack Vector

The attack vector is local and requires user interaction: a target must open or process a malicious PNG. Impact is limited to confidentiality and availability of the host process, with no direct integrity impact.

       int i;
 
       /* Initialize the array to index colors.
+       *
+       * Ensure quantize_index can fit 256 elements (PNG_MAX_PALETTE_LENGTH)
+       * rather than num_palette elements. This is to prevent buffer overflows
+       * caused by malformed PNG files with out-of-range palette indices.
        *
        * Be careful to avoid leaking memory. Applications are allowed to call
        * this function more than once per png_struct.
        */
       png_free(png_ptr, png_ptr->quantize_index);
       png_ptr->quantize_index = (png_bytep)png_malloc(png_ptr,
-          (png_alloc_size_t)num_palette);
-      for (i = 0; i < num_palette; i++)
+          PNG_MAX_PALETTE_LENGTH);
+      for (i = 0; i < PNG_MAX_PALETTE_LENGTH; i++)
          png_ptr->quantize_index[i] = (png_byte)i;
    }

Source: libpng commit 6a528eb. The patch enlarges the quantize_index allocation to PNG_MAX_PALETTE_LENGTH (256) so lookups from malformed palette indices remain within bounds.

Detection Methods for CVE-2025-64505

Indicators of Compromise

Process crashes or ASAN heap-buffer-overflow reports originating from png_do_quantize in pngrtran.c.
Untrusted PNG files whose PLTE chunk or referenced palette indices exceed the declared num_palette value.
Applications linked against libpng versions below 1.6.51 that expose PNG parsing to untrusted input.

Detection Strategies

Inventory installed libpng versions across endpoints and build pipelines and flag any version earlier than 1.6.51.
Use software composition analysis (SCA) to identify statically linked or bundled copies of libpng inside third-party binaries.
Run fuzzing or AddressSanitizer builds against PNG-processing components to surface out-of-bounds reads in png_do_quantize.

Monitoring Recommendations

Monitor image-processing services and desktop applications for unexpected crashes or segmentation faults tied to PNG parsing.
Alert on repeated application faults referencing libpng or pngrtran.c in crash dumps and telemetry.
Track file uploads containing PNGs with anomalous palette structures across web and email gateways.

How to Mitigate CVE-2025-64505

Immediate Actions Required

Upgrade libpng to version 1.6.51 or later on all affected systems.
Rebuild and redistribute applications that statically link libpng using the patched release.
Apply operating system and distribution updates that ship the fixed libpng package.

Patch Information

The fix is available in libpng 1.6.51 via commit 6a528eb5fd0dd7f6de1c39d30de0e41473431c37. Full details are in the libpng GHSA-4952-h5wq-4m42 advisory and the upstream pull request #748.

Workarounds

Disable the PNG quantization code path in applications where it is optional until the patched libpng is deployed.
Restrict processing of PNG files from untrusted sources at web, email, and file-sharing gateways.
Sandbox image-parsing components so that out-of-bounds reads cannot access sensitive in-process data.

bash

# Verify installed libpng version and update on Debian/Ubuntu
dpkg -l | grep libpng
sudo apt-get update && sudo apt-get install --only-upgrade libpng16-16

# Verify installed libpng version and update on RHEL/Fedora
rpm -q libpng
sudo dnf update libpng