CVE-2026-22695

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
pnggroup	libpng	< 1.6.54

References

https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1eaPatch
https://github.com/pnggroup/libpng/commit/e4f7ad4ea2Patch
https://github.com/pnggroup/libpng/issues/778Exploit, Issue Tracking, Third Party Advisory
https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxppExploit, Third Party Advisory

Timeline

Published: Jan 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-226969.3dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to CVE-2026-226977.5CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure comm CVE-2026-226987.5RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing variou CVE-2026-226997.5RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing variou CVE-2026-22705.9A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and CVE-2026-227007.5RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing variou CVE-2026-227015.3filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFi CVE-2026-227024.5virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnera CVE-2026-227035.5Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted t CVE-2026-227045.4HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XS CVE-2026-227056.4RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to v CVE-2026-227066.5Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did