CVE-2025-65018

Katalog CVE

CVSS 7.1 · High EPSS 0,26%

Kerentanan Heap-based Buffer Overflow pada libpng. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

Rincian

Terbit di NVD

25 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g exploit · advisory vendor
• https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d patch
• https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea patch
• https://github.com/pnggroup/libpng/issues/755 exploit · issue tracking
• https://github.com/pnggroup/libpng/pull/757 issue tracking