CVE-2025-64505

Katalog CVE

CVSS 6.1 · Medium EPSS 0,19%

Kerentanan Out-of-bounds Read pada libpng. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.

Rincian

Terbit di NVD

25 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42 advisory vendor
• https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37 patch
• https://github.com/pnggroup/libpng/pull/748 issue tracking