CVE-2025-65018: Libpng Buffer Overflow Vulnerability

CVE-2025-65018 Overview

CVE-2025-65018 is a heap buffer overflow vulnerability in the libpng library, the reference implementation for reading, creating, and manipulating PNG (Portable Network Graphics) raster image files. The vulnerability exists in the simplified API function png_image_finish_read when processing 16-bit interlaced PNG images with 8-bit output format. Attacker-crafted interlaced PNG files can cause heap writes beyond allocated buffer bounds, potentially leading to memory corruption and application crashes.

Critical Impact

Maliciously crafted PNG files can trigger heap buffer overflow conditions, enabling attackers to corrupt memory and potentially achieve code execution or cause denial of service in applications using vulnerable libpng versions.

Affected Products

• libpng versions 1.6.0 to before 1.6.51
• Applications and software packages that bundle or dynamically link to vulnerable libpng versions
• Image processing tools and libraries utilizing the libpng simplified API

Discovery Timeline

• 2025-11-25 - CVE-2025-65018 published to NVD
• 2025-11-26 - Last updated in NVD database

Technical Details for CVE-2025-65018

Vulnerability Analysis

This heap buffer overflow vulnerability (CWE-122) occurs in the png_image_finish_read function within libpng's simplified API. The vulnerability is triggered when an application attempts to read a 16-bit interlaced PNG image while specifying an 8-bit output format. Due to improper validation of the bit depth mismatch between the source PNG and the requested output format, the library performs heap writes that exceed the bounds of the allocated output buffer.

The vulnerability requires user interaction—specifically, an attacker must convince a victim to open or process a maliciously crafted PNG file. Once triggered, the heap corruption can lead to application crashes, denial of service, or potentially more severe consequences depending on the application's memory layout and usage patterns.

Root Cause

The root cause is a missing validation check for bit depth compatibility between the source PNG file's color depth and the application's requested output format. When a 16-bit interlaced PNG is processed with an 8-bit output format request, the buffer size calculations assume 8-bit output while the actual write operations process 16-bit data, resulting in writes beyond the allocated buffer boundaries.

Attack Vector

The attack requires local access where an attacker must deliver a specially crafted PNG file to the target system. The victim must then open or process this file using an application that utilizes vulnerable libpng versions with the simplified API. The attacker crafts an interlaced PNG with 16-bit color depth that triggers the buffer overflow when the application processes it with an 8-bit output format specification.

                   int result;
                   png_image_read_control display;
 
+                  /* Reject bit depth mismatches to avoid buffer overflows. */
+                  png_uint_32 ihdr_bit_depth =
+                      image->opaque->png_ptr->bit_depth;
+                  int requested_linear =
+                      (image->format & PNG_FORMAT_FLAG_LINEAR) != 0;
+                  if (ihdr_bit_depth == 16 && !requested_linear)
+                     return png_image_error(image,
+                         "png_image_finish_read: "
+                         "16-bit PNG must use 16-bit output format");
+                  if (ihdr_bit_depth < 16 && requested_linear)
+                     return png_image_error(image,
+                         "png_image_finish_read: "
+                         "8-bit PNG must not use 16-bit output format");
+
                   memset(&display, 0, (sizeof display));
                   display.image = image;
                   display.buffer = buffer;

Source: GitHub libpng Commit

Detection Methods for CVE-2025-65018

Indicators of Compromise

• Unexpected application crashes when processing PNG image files
• Memory corruption errors or heap-related exceptions in image processing applications
• Anomalous PNG files with 16-bit color depth and interlaced encoding in unexpected locations
• Core dumps or crash logs indicating heap overflow in libpng-related functions

Detection Strategies

• Monitor for application crashes that reference png_image_finish_read or related libpng functions in stack traces
• Implement file integrity monitoring to detect suspicious PNG files with unusual characteristics
• Deploy memory protection tools such as AddressSanitizer (ASan) in development and testing environments to detect heap overflows
• Use static analysis tools to identify applications using vulnerable libpng versions

Monitoring Recommendations

• Enable crash reporting and analysis for applications that process PNG images
• Implement logging for image processing operations to track file sources and processing outcomes
• Monitor system logs for memory-related errors in applications using libpng
• Establish baseline behavior for image processing applications to detect anomalous activity

How to Mitigate CVE-2025-65018

Immediate Actions Required

• Update libpng to version 1.6.51 or later immediately
• Audit all applications and systems to identify those using vulnerable libpng versions (1.6.0 to before 1.6.51)
• Review dependencies and software packages that may bundle libpng internally
• Consider restricting the processing of untrusted PNG files until patches are applied

Patch Information

The vulnerability has been patched in libpng version 1.6.51. The fix introduces explicit validation checks in png_image_finish_read to reject bit depth mismatches that would result in buffer overflows. Two commits address this issue: the initial fix adds validation logic, and a subsequent commit rearchitects the fix for improved handling of interlaced 16-to-8 bit depth conversions. For complete details, refer to the GitHub Security Advisory GHSA-7wv6-48j4-hj3g.

Workarounds

• Avoid processing untrusted or unknown PNG files with applications using vulnerable libpng versions
• Ensure 16-bit PNG images are processed with 16-bit output formats (use PNG_FORMAT_FLAG_LINEAR)
• Implement input validation to reject or quarantine PNG files from untrusted sources
• Consider using sandboxed environments for image processing operations until patches are applied

# Verify libpng version on Linux systems
pkg-config --modversion libpng

# Check for vulnerable versions and update via package manager
# Debian/Ubuntu
apt update && apt upgrade libpng16-16

# RHEL/CentOS/Fedora
dnf update libpng

# Verify updated version
pkg-config --modversion libpng