CVE-2026-22695

CVE-2026-22695: When Fixing a Buffer Overflow Creates a Buffer Over-read

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 23, 2026·5 min read·14 visits

Executive Summary (TL;DR)

Developers fixed a heap overflow in libpng (CVE-2025-65018) but accidentally introduced a heap over-read. By confusing the destination 'stride' with the source 'width' during a `memcpy` operation, the library reads out-of-bounds. This is triggered by interlaced 16-bit PNGs and can result in immediate crashes (via negative strides) or heap memory disclosure.

A regression in libpng's simplified API allows for a heap-based buffer over-read. Introduced while fixing a previous vulnerability, this flaw permits attackers to trigger a Denial of Service or potentially leak heap memory by manipulating the row stride in 16-bit interlaced PNGs.

Fix Analysis (1)

Technical Appendix

CVSS Score
6.1/ 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS Probability
0.02%
Top 96% most exploited

Affected Systems

ImageMagick (older versions linked against vulnerable libpng)Browsers or viewers using the libpng simplified APIGaming engines loading textures via libpngLinux distributions (Fedora, Debian, Arch) carrying libpng 1.6.51-1.6.53

Affected Versions Detail

Product
Affected Versions
Fixed Version
libpng
PNG Reference Library Group
>= 1.6.51, <= 1.6.531.6.54
AttributeDetail
CWE IDCWE-125 (Out-of-bounds Read)
CVSS v3.16.1 (Medium)
Attack VectorLocal / User Interaction (File Open)
ImpactInformation Disclosure / Denial of Service
EPSS Score0.00018
Affected Componentpng_image_read_direct_scaled
CWE-125
Out-of-bounds Read

The software reads data past the end, or before the beginning, of the intended buffer.

Vulnerability Timeline

Vulnerable code introduced in commit 218612ddd (Regression)
2025-11-19
Vulnerability reported by Petr Simecek
2026-01-06
Fix committed by Cosmin Truta
2026-01-09
libpng 1.6.54 released
2026-01-12

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.