Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 533
Alerts This Week
Warning Icon 1 533

openSUSE: libpng16 Important Buffer Overflow Sync Summary 2026:20017-1

opensuse
Calendar Grey January 13, 2026
Dist Opensuse Esm H88
Install the latest openSUSE update for libpng16 addressing 5 important security issues and bug fixes.
An update that solves 5 vulnerabilities and has 5 bug fixes can now be installed.

Description

This update for libpng16 fixes the following issues:

- CVE-2025-64505: heap buffer over-read in `png_do_quantize` when processing PNG files malformed palette indices

(bsc#1254157).

- CVE-2025-64506: heap buffer over-read in `png_write_image_8bit` when processing 8-bit input with `convert_to_8bit`

enabled (bsc#1254158).

- CVE-2025-64720: out-of-bounds read in `png_image_read_composite` when processing palette images with

`PNG_FLAG_OPTIMIZE_ALPHA` enabled (bsc#1254159).

- CVE-2025-65018: heap buffer overflow in `png_image_finish_read` when processing specially crafted 16-bit interlaced

PNGs with 8-bit output format (bsc#1254160).

- CVE-2025-66293: out-of-bounds read of the `png_sRGB_base` array when processing palette PNG images with partial

transparency and gamma correction (bsc#1254480).

Patch instructions:

To install this openSUSE security update use the suse recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory important out-of-bounds OpenSUSE buffer over-read libpng16

Patch

Package List

- openSUSE Leap 16.0:

libpng16-16-1.6.44-160000.3.1

libpng16-16-x86-64-v3-1.6.44-160000.3.1

libpng16-compat-devel-1.6.44-160000.3.1

libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1

libpng16-devel-1.6.44-160000.3.1

libpng16-devel-x86-64-v3-1.6.44-160000.3.1

libpng16-tools-1.6.44-160000.3.1

References

* bsc#1254157

* bsc#1254158

* bsc#1254159

* bsc#1254160

* bsc#1254480

References:

* https://www.suse.com/security/cve/CVE-2025-64505.html

* https://www.suse.com/security/cve/CVE-2025-64506.html

* https://www.suse.com/security/cve/CVE-2025-64720.html

* https://www.suse.com/security/cve/CVE-2025-65018.html

* https://www.suse.com/security/cve/CVE-2025-66293.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2026:20017-1
Rating: important
Affected Products: openSUSE Leap 16.0 -------------------------------------------------------------

Topics%20covered

Topics Covered

security advisory important out-of-bounds OpenSUSE buffer over-read libpng16

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.