Debian alert DLA-4481-1 (libpng1.6)

From:
             
 
Tobias Frost <tobi@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4481-1] libpng1.6 security update
Date:
             
 
Tue, 17 Feb 2026 19:25:10 +0100
Message-ID:
             
 
<aZSyhlWwnAC_wBXu@isildor2.loewenhoehle.ip>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4481-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Tobias Frost
February 17, 2026                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : libpng1.6
Version        : 1.6.37-3+deb11u2
CVE ID         : CVE-2026-22695 CVE-2026-22801 CVE-2026-25646
Debian Bug     : 1125443 1125444 1127566

Multiple vulnerabilties have been found in libpng, the official PNG
reference library, allowing information disclosure via out-of-bounds
read, denial of service via infinite loop.

CVE-2026-22695

  There is a heap buffer over-read in the libpng simplified API function
  png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit
  output format and non-minimal row stride. This is a regression
  introduced by the fix for CVE-2025-65018.
  
CVE-2026-22801
  
  There is an integer truncation in the libpng simplified write API
  functions png_write_image_16bit and png_write_image_8bit causes heap
  buffer over-read when the caller provides a negative row stride (for
  bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was
  introduced in libpng 1.6.26 (October 2016) by casts added to silence
  compiler warnings on 16-bit systems. 
  
CVE-2026-25646
  
  A out-of-bounds read vulnerability exists in the png_set_quantize() API
  function.  When the function is called with no histogram and the number
  of colors in the palette is more than twice the maximum supported by the
  user's display, certain palettes will cause the function to enter into
  an infinite loop that reads past the end of an internal heap-allocated
  buffer. The images that trigger this vulnerability are valid per the PNG
  specification. 

For Debian 11 bullseye, these problems have been fixed in version
1.6.37-3+deb11u2.

We recommend that you upgrade your libpng1.6 packages.

For the detailed security status of libpng1.6 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libpng1.6

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE/d0M/zhkJ3YwohhskWT6HRe9XTYFAmmUsoQACgkQkWT6HRe9
XTYtrA//eOltFHazH91Vsl4FotPGgkgWV1aFATIo5cUmw+WLralDhEbnUxcEb4Jb
8dFHwzkLpKxjTUCQvzXD2vQLBROS67gqVttLaAzXq5m4mxpmLfyIcrnhMXtziEMO
KnLt0j1nXM2u0nLMWcNNwMdCmRci69FmXcOfeTGcoorswGoiwLC+FM41Tser7d7Y
Mj3hnvCKMGBErmn1RBE9cZdzT4DEc0WrVkuVhZti481+eGxLJ4qW/oKVfOmf82Q8
wmjPkCU+gAaIQlXU0wspOJlwcDA5HAnrFVwmr3s9O/sTQSHsqrxpRPk3/OkLWA/l
rCmSd5uNw7wWRA4YT6zlCVKCHIkhMQqKruNQscffy+oNHLIOcHp+cpIpdsq12E3e
q2kNA0wmtAcklJvdm+ro5WevPSODG6s5uhJIUsBPJ9FAI+/s4jSAfFb/X9yorUDx
911zdsEhCVuG0wnIhBi4IgcPQWShv7jE+8aKGP7SY2giMP2b+x9bCi2Iy49q0MTe
V+UbwiBPa36w+lUyGHIesSOy4DtGXdtHVu8sFGgBXjXrhGLlYkojJuW4SueOo94q
eX0WL+/3Mwxtohi4lWJtAmvDh0Oo5omk2oO6lhQM3BYQaz3jG34kQ0K0kavRIKL0
P2KZU5o9EuthR/CrHitrob/HFgpnwa/N+nxBBHhubf3HkSqu6vg=
=uZms
-----END PGP SIGNATURE-----