CVE-2026-22801

Pixel Imperfect: The libpng Integer Truncation Vulnerability

Alon Barad
Alon Barad
Software Engineer

Jan 23, 2026·7 min read·25 visits

Executive Summary (TL;DR)

Between versions 1.6.26 and 1.6.53, libpng's simplified write API contains a nasty integer truncation bug. When handling large row strides (images wider than ~16k pixels in 16-bit mode) or negative strides (common in BMP conversion), an explicit cast to `png_uint_16` chops off the high bits. This causes the library to miscalculate memory offsets, reading out-of-bounds heap data and potentially writing it into the output PNG or crashing the application. Fixed in 1.6.54.

A classic integer truncation vulnerability in the widespread libpng library enables heap buffer over-reads. Hidden within the 'simplified' write API, this 10-year-old bug punishes developers for ignoring compiler warnings the wrong way, turning wide images into memory leaks.

Fix Analysis (1)

Technical Appendix

CVSS Score
6.8/ 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS Probability
0.01%
Top 100% most exploited

Affected Systems

ImageMagick (older builds linking vulnerable libpng)Browsers (embedded components)Linux Distributions (packages prior to Jan 2026 update)Scientific imaging tools using simplified APIWeb-based image conversion services

Affected Versions Detail

Product
Affected Versions
Fixed Version
libpng
PNG Group
>= 1.6.26, <= 1.6.531.6.54
AttributeDetail
CWE IDCWE-190 (Integer Truncation)
Attack VectorLocal / Context-Dependent
CVSS v3.16.8 (Medium)
ImpactHeap Over-read (Info Leak) / DoS
Affected ComponentSimplified Write API (png_write_image_*)
Fix Version1.6.54
CWE-190
Integer Truncation

The software performs an integer calculation that can produce an integer overflow or wraparound, causing the program to use the wrong value for memory offsets.

Vulnerability Timeline

Vulnerability introduced in libpng 1.6.26 via compiler warning fix.
2016-10-01
Vulnerability disclosed and fixed in version 1.6.54.
2026-01-12
Linux distributions begin patching downstream packages.
2026-01-14

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.