CVE-2025-66293 @ mufasa
Status
new
Priority
6.6
Match score
4.0
Risk
DoS
Remote
CVSS
7.1 HIGH
Reason
cpe: libpng; pkgs: libpng, libpng-devel; version: in-range: libpng-1.5.13-8.el7, libpng-devel-1.5.13-8.el7; risk:dos
Created
2026-10-19T10:18:08Z
Updated
2026-10-20T10:17:44Z
Package interrogation (copy)
Run on the host — click to copy a command. RPM
| Package | Commands |
|---|---|
| libpng-1.5.13-8.el7 | |
| libpng-devel-1.5.13-8.el7 |
Inventory lookup
Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.
Suggestions: libpng · libpng-devel
| System | Matches | Ticket for CVE-2025-66293 | |
|---|---|---|---|
| morris | libpng 1.5.13; libpng-devel 1.5.13 | new open | |
| mufasa | libpng 1.5.13; libpng-devel 1.5.13 | new open | |
| Archive | libpng16-16 1.6.36-6 | none | |
| Bullseye | libpng16-16 1.6.37-3+deb11u4 | none | |
| Helios | libpng-dev 1.6.37-3+deb11u4; libpng-tools 1.6.37-3+deb11u4; libpng16-16 1.6.37-3+deb11u4 | none | |
| Janus | libpng16-16 1.6.36-6 | none | |
| Library | libpng12-0 1.2.50-2+deb8u3; libpng16-16 1.6.28-1+deb9u1 | none | |
| Matrix | libpng16-16 1.6.39-2+deb12u6 | none | |
| Saiph | libpng12-0 1.2.50-2+deb8u3; libpng16-16 1.6.36-6 | none | |
| Silk | libpng16-16 1.6.39-2+deb12u6 | none |
Same product CVEs in your queue
Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.
| CVE | CVSS | KEV | Systems | Status | Matched | Already related | |
|---|---|---|---|---|---|---|---|
| CVE-2015-8126 | - | morris, mufasa | new | libpng | — |
Related CVE (same fix)
Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.
Host OS / kernel
OS
CloudLinux release 7.9 (Boris Yegorov)
(7.9)
· cloudlinux
Arch
x86_64
kernel_release
uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64kernel_version
uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.
Same CVE on other hosts
Open the ticket for this CVE on another system.
| System | Status | Priority | Updated | |
|---|---|---|---|---|
| morris | new | 6.6 | 2026-10-20T10:17:44Z | Open |
Description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.
Update status
Add note only
References
- https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1
- https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a
- https://github.com/pnggroup/libpng/issues/764
- https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f
- http://www.openwall.com/lists/oss-security/2025/12/03/6
- http://www.openwall.com/lists/oss-security/2025/12/03/7
- http://www.openwall.com/lists/oss-security/2025/12/03/8
- https://github.com/pnggroup/libpng/issues/764
NVD: CVE-2025-66293