pnggroup libpng up to 1.6.53 Simplified Write API png_write_image_16bit out-of-bounds

Summaryinfo

A vulnerability was found in pnggroup libpng up to 1.6.53 and classified as critical. This affects the function png_write_image_16bit of the component Simplified Write API. Executing a manipulation can lead to out-of-bounds. This vulnerability is registered as CVE-2026-22801. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in pnggroup libpng up to 1.6.53. It has been declared as critical. This vulnerability affects the function png_write_image_16bit of the component Simplified Write API. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-22801 since 01/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 282644 (Linux Distros Unpatched Vulnerability : CVE-2026-22801), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.6.54 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (282644) and CERT Bund (WID-SEC-2026-0068). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• Open Source libpng
• Meinberg LANTIME
• Dell Secure Connect Gateway

Productinfo

Type

• Image Processing Software

Vendor

• pnggroup

Name

• libpng

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17
• 1.6.18
• 1.6.19
• 1.6.20
• 1.6.21
• 1.6.22
• 1.6.23
• 1.6.24
• 1.6.25
• 1.6.26
• 1.6.27
• 1.6.28
• 1.6.29
• 1.6.30
• 1.6.31
• 1.6.32
• 1.6.33
• 1.6.34
• 1.6.35
• 1.6.36
• 1.6.37
• 1.6.38
• 1.6.39
• 1.6.40
• 1.6.41
• 1.6.42
• 1.6.43
• 1.6.44
• 1.6.45
• 1.6.46
• 1.6.47
• 1.6.48
• 1.6.49
• 1.6.50
• 1.6.51
• 1.6.52
• 1.6.53

License

• open-source

Website

• Product: https://github.com/pnggroup/libpng/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion