Allocation of Resources Without Limits or Throttling Affecting libpng package, versions [,1.6.52)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-LIBPNG-14176097
- published4 Dec 2025
- disclosed3 Dec 2025
- creditFlyFish
Introduced: 3 Dec 2025
NewCVE-2025-66293 (opens in a new tab)How to fix?
Upgrade libpng to version 1.6.52 or higher.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the png_image_read_composite function when processing valid palette PNG images with partial transparency and gamma correction. An attacker can cause information disclosure or application crash by supplying a crafted PNG file that triggers an out-of-bounds read.
Workaround
If immediate upgrade is not possible, this vulnerability can be mitigated by:
Provide an explicit background color to
png_image_finish_read(uses different code path).Use the low-level API instead of simplified API.
Request alpha-preserving output (e.g.,
PNG_FORMAT_RGBA) to avoid composition path.