Back Linuxsecurity

Mageia 9: libpng Important Heap Overflow Advisory MGASA-2025

Linuxsecurity •LinuxSecurity Advisories • December 1, 2025

Description: LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index. (CVE-2025-64505) LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images. (CVE-2025-64506) LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication. (CVE-2025-64720) LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`. (CVE-2025-65018)

- - - - - -

MGASA-2025-0314 - Updated libpng packages fix security vulnerabilities

- 9/core/libpng-1.6.38-1.1.mga9

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Buffer Overflow Vulnerabilities Found in libpng libpng has been identified with several vulnerabilities, including heap buffer overflows and over-reads. The vulnerabilities affect various functions such as `png_do_quantize` and `png_write_image_8bit`, with CVEs assigned for each issue. Both Mageia and Slackware distributions have released advisories and patches to address these security concerns. 5 sources 31

Extracted Entities

CVEs (4)

CVE-2025-64505 CVE-2025-64506 CVE-2025-64720 CVE-2025-65018

Platforms (2)

Libpng Mageia 9