Debian LTS DLA-4481-1 libpng Critical Denial of Service and Info Disclosure

CVE-2026-22695

There is a heap buffer over-read in the libpng simplified API function
png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit
output format and non-minimal row stride. This is a regression
introduced by the fix for CVE-2025-65018.

CVE-2026-22801

There is an integer truncation in the libpng simplified write API
functions png_write_image_16bit and png_write_image_8bit causes heap
buffer over-read when the caller provides a negative row stride (for
bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was
introduced in libpng 1.6.26 (October 2016) by casts added to silence
compiler warnings on 16-bit systems.

CVE-2026-25646

A out-of-bounds read vulnerability exists in the png_set_quantize() API
function. When the function is called with no histogram and the number
of colors in the palette is more than twice the maximum supported by the
user's display, certain palettes will cause the function to enter into