CVE-2025-64506: Libpng Buffer Overflow Vulnerability

CVE-2025-64506 Overview

CVE-2025-64506 is a heap buffer over-read vulnerability in libpng, the reference library for reading, creating, and manipulating PNG raster image files. The flaw exists in the png_write_image_8bit function within the simplified write API when convert_to_8bit is enabled. A faulty conditional guard allows 8-bit input to enter a code path expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. Versions 1.6.0 through 1.6.50 are affected, and the issue is patched in 1.6.51.

Critical Impact
Applications using the libpng simplified write API to convert images to 8-bit format may crash or leak adjacent heap memory when processing attacker-supplied PNG images.

Affected Products

libpng versions 1.6.0 through 1.6.50
Applications linking libpng and using the simplified write API with convert_to_8bit
Downstream distributions and software bundling vulnerable libpng builds

Discovery Timeline

2025-11-25 - CVE-2025-64506 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64506

Vulnerability Analysis

The vulnerability is classified as an Out-of-Bounds Read [CWE-125]. It resides in pngwrite.c, specifically in png_write_image_8bit, which handles pixel data conversion during PNG writes via the simplified API. The function uses a conditional to determine when a temporary linearized row buffer is needed. That conditional incorrectly permits 8-bit inputs with convert_to_8bit set to fall through into a branch that assumes a 16-bit source layout.

Because the branch reads two bytes per channel from a buffer sized for one byte per channel, the code performs reads past the allocated row bounds. The over-read can span up to 2 bytes beyond the buffer, depending on channel layout (grayscale+alpha, RGB, RGBA) and whether the row data is incomplete. Exploitation requires user interaction to open or process a crafted image, and the impact is limited to availability loss and partial memory disclosure.

Root Cause

The root cause is an incorrect boolean guard combining linear, alpha, colormap, and convert_to_8bit flags. The original expression treated convert_to_8bit as an independent trigger for the 16-bit code path, ignoring the requirement that linear != 0 must also hold. The corrected expression enforces linear != 0 && (alpha != 0 || display->convert_to_8bit != 0).

Attack Vector

An attacker supplies a crafted PNG file to an application that invokes the libpng simplified write API with convert_to_8bit enabled. Processing triggers the over-read, which can cause a crash or expose adjacent heap contents through subsequent write output or error channels. The attack vector is local and requires user interaction.

     * before it is written.  This only applies when the input is 16-bit and
     * either there is an alpha channel or it is converted to 8-bit.
     */
-   if ((linear != 0 && alpha != 0 ) ||
-       (colormap == 0 && display->convert_to_8bit != 0))
+   if (linear != 0 && (alpha != 0 || display->convert_to_8bit != 0))
    {
       png_bytep row = png_voidcast(png_bytep, png_malloc(png_ptr,
           png_get_rowbytes(png_ptr, info_ptr)));

Source: libpng commit 2bd84c0

Detection Methods for CVE-2025-64506

Indicators of Compromise

Application crashes or segmentation faults in processes linking libpng when handling PNG files
AddressSanitizer or Valgrind reports of heap-buffer-overflow reads inside png_write_image_8bit
Unexpected image write failures when converting 16-bit or grayscale+alpha inputs to 8-bit

Detection Strategies

Inventory installed libpng versions across endpoints and build pipelines and flag any release before 1.6.51
Scan container images, application dependencies, and static binaries for bundled vulnerable libpng builds
Enable compiler hardening and sanitizers in development to surface out-of-bounds reads during image processing

Monitoring Recommendations

Monitor crash telemetry and core dumps from image-handling services for faults inside libpng write routines
Track file-processing services that accept user-supplied PNG uploads for abnormal termination patterns
Correlate software bill of materials (SBOM) data with the fixed version 1.6.51 to identify residual exposure

How to Mitigate CVE-2025-64506

Immediate Actions Required

Upgrade libpng to version 1.6.51 or later across all systems and rebuild dependent applications
Identify statically linked binaries and container images that embed libpng and rebuild them against the patched library
Restrict processing of untrusted PNG files in workflows that invoke the simplified write API with convert_to_8bit enabled

Patch Information

The vulnerability is fixed in libpng 1.6.51. Review the GitHub Security Advisory GHSA-qpr4-xm66-hww6 and the upstream fix commit for full details. The corrective change tightens the conditional in png_write_image_8bit so that 8-bit inputs no longer enter the 16-bit code path.

Workarounds

Disable the convert_to_8bit option in applications using the libpng simplified write API until the patched library is deployed
Validate and constrain input PNG dimensions and channel layouts before passing images to libpng write routines
Sandbox image-processing components to limit the blast radius of a crash or memory disclosure

bash

# Verify installed libpng version
pkg-config --modversion libpng
# Expected: 1.6.51 or later

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libpng16-16

# RHEL/Fedora
sudo dnf upgrade libpng