CVE-2026-22695
Medium
Description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.
SeverityMedium
CVSS6.1
Exploit probability—
ProductLibpng
PublishedJan 12, 2026
First seenJan 12, 2026
Weakness typeCWE-125Out-of-bounds read
How to fix
Update
- libpng libpng1.6.54 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libpng libpng | 1.6.51 ≤ v < 1.6.54 | 1.6.54 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.