CVE-2025-64720: Libpng Buffer Overflow Vulnerability

CVE-2025-64720 Overview

CVE-2025-64720 is an out-of-bounds read vulnerability in libpng, the reference library for reading, creating, and manipulating PNG (Portable Network Graphics) raster image files. The vulnerability exists in the png_image_read_composite function when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API.

Critical Impact

Network-accessible out-of-bounds read vulnerability that can lead to information disclosure and application crashes when processing maliciously crafted PNG images.

Affected Products

• libpng versions 1.6.0 to 1.6.50
• Applications using libpng for PNG image processing
• Systems with vulnerable libpng library installations

Discovery Timeline

• 2025-11-25 - CVE-2025-64720 published to NVD
• 2025-11-26 - Last updated in NVD database

Technical Details for CVE-2025-64720

Vulnerability Analysis

This out-of-bounds read vulnerability (CWE-125) occurs within the PNG image processing pipeline when certain optimization flags are enabled. The core issue lies in how the library handles palette-based images with alpha channel optimization. When PNG_FLAG_OPTIMIZE_ALPHA is set, the png_init_read_transformations function performs premultiplication operations that can violate expected bounds constraints.

The simplified PNG API requires that color component values maintain a specific invariant relationship with alpha values (component ≤ alpha × 257). However, the vulnerable code path incorrectly applies background compositing during the premultiplication process, causing this invariant to be violated. This can result in out-of-bounds memory access when the library attempts to read palette data beyond allocated buffer boundaries.

Root Cause

The root cause stems from incorrect logic in the palette compositing code within png_init_read_transformations. When processing transparent palette entries (where trans_alpha[i] != 0xff), the original code performed background compositing using png_composite() even when only premultiplication should occur. This mixing of operations corrupted the expected relationship between color components and alpha values, leading to invalid array index calculations in subsequent processing steps.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious PNG image with specific palette and transparency configurations. When a vulnerable application processes this image using libpng with PNG_FLAG_OPTIMIZE_ALPHA enabled, the out-of-bounds read is triggered. The attack is network-accessible, meaning malicious images can be delivered via web pages, email attachments, or other network-based delivery mechanisms. User interaction is required as the victim must open or view the malicious image.

// Security patch in pngrtran.c - Fix a buffer overflow in `png_init_read_transformations`
// Source: https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643

                   }
                   else /* if (png_ptr->trans_alpha[i] != 0xff) */
                   {
-                     png_byte v, w;
-
-                     v = png_ptr->gamma_to_1[palette[i].red];
-                     png_composite(w, v, png_ptr->trans_alpha[i], back_1.red);
-                     palette[i].red = png_ptr->gamma_from_1[w];
-
-                     v = png_ptr->gamma_to_1[palette[i].green];
-                     png_composite(w, v, png_ptr->trans_alpha[i], back_1.green);
-                     palette[i].green = png_ptr->gamma_from_1[w];
-
-                     v = png_ptr->gamma_to_1[palette[i].blue];
-                     png_composite(w, v, png_ptr->trans_alpha[i], back_1.blue);
-                     palette[i].blue = png_ptr->gamma_from_1[w];
+                     if ((png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0)
+                     {
+                        /* Premultiply only:
+                         * component = round((component * alpha) / 255)
+                         */
+                        png_uint_32 component;
+
+                        component = png_ptr->gamma_to_1[palette[i].red];
+                        component =
+                            (component * png_ptr->trans_alpha[i] + 128) / 255;
+                        palette[i].red = png_ptr->gamma_from_1[component];
+
+                        component = png_ptr->gamma_to_1[palette[i].green];
+                        component =

Detection Methods for CVE-2025-64720

Indicators of Compromise

• Unexpected application crashes when processing PNG images with palette-based transparency
• Memory access violations or segmentation faults in processes using libpng
• Anomalous read operations in memory regions adjacent to PNG palette buffers
• Application logs showing errors related to PNG image decoding with alpha optimization

Detection Strategies

• Monitor for crashes in applications that process PNG images, particularly those using the simplified API
• Implement file integrity monitoring for libpng library files to detect outdated versions
• Use memory sanitization tools (ASan, MSan) in development environments to detect out-of-bounds reads
• Deploy intrusion detection rules to identify malformed PNG files with suspicious palette configurations

Monitoring Recommendations

• Enable verbose logging in image processing applications to capture PNG decoding errors
• Monitor system crash reports for patterns indicating libpng-related memory violations
• Track libpng version inventory across infrastructure to identify vulnerable deployments
• Implement automated vulnerability scanning for libpng versions between 1.6.0 and 1.6.50

How to Mitigate CVE-2025-64720

Immediate Actions Required

• Upgrade libpng to version 1.6.51 or later immediately
• Audit systems and applications to identify all instances of vulnerable libpng versions
• Consider temporarily disabling PNG_FLAG_OPTIMIZE_ALPHA if immediate patching is not possible
• Prioritize patching on systems that process untrusted PNG images from external sources

Patch Information

The vulnerability has been patched in libpng version 1.6.51. The fix modifies the palette compositing logic in png_init_read_transformations to correctly handle premultiplication when PNG_FLAG_OPTIMIZE_ALPHA is enabled, without incorrectly applying background compositing. The patch ensures that the invariant component ≤ alpha × 257 is maintained throughout the processing pipeline.

For detailed patch information, refer to:

• GitHub Commit 08da33b4c88cfcd36e5a706558a8d7e0e4773643
• GitHub Pull Request #751
• GitHub Security Advisory GHSA-hfc7-ph9c-wcww

Workarounds

• Disable PNG_FLAG_OPTIMIZE_ALPHA flag in applications where immediate patching is not feasible
• Implement input validation to reject PNG images with suspicious palette configurations
• Use sandboxing or containerization to isolate PNG image processing from critical systems
• Deploy web application firewalls with rules to inspect uploaded PNG files for malformed structures

# Configuration example - Check libpng version and update on Debian/Ubuntu systems
# Check current libpng version
pkg-config --modversion libpng

# Update libpng to patched version
sudo apt update && sudo apt upgrade libpng16-16

# Verify the update
dpkg -l | grep libpng