CVE-2026-22801 LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora libpng Vulnerability CVE-2026-22695 Addressed The libpng package in Fedora has been updated to address CVE-2026-22695, a medium severity heap buffer over-read vulnerability. This affects users who manipulate PNG image files, necessitating an update to version 1.6.54 released on January 12, 2026. 10 sources 31