Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 526
Alerts This Week
Warning Icon 1 526

SUSE: libpng16 Important Security Patch 2026:20073-1 CVE-2025-64505

suse
Calendar Grey January 15, 2026
Dist Suse Esm H88
A security update for SUSE's libpng16 addresses five important vulnerabilities that require prompt attention.
An update that solves five vulnerabilities can now be installed.

Summary

## This update for libpng16 fixes the following issues: * CVE-2025-64505: heap buffer over-read in `png_do_quantize` when processing PNG files malformed palette indices (bsc#1254157). * CVE-2025-64506: heap buffer over-read in `png_write_image_8bit` when processing 8-bit input with `convert_to_8bit` enabled (bsc#1254158). * CVE-2025-64720: out-of-bounds read in `png_image_read_composite` when processing palette images with `PNG_FLAG_OPTIMIZE_ALPHA` enabled (bsc#1254159). * CVE-2025-65018: heap buffer overflow in `png_image_finish_read` when processing specially crafted 16-bit interlaced PNGs with 8-bit output format (bsc#1254160). * CVE-2025-66293: out-of-bounds read of the `png_sRGB_base` array when processing palette PNG images with partial transparency and gamma correction

Topics%20covered

Topics Covered

security advisory buffer overflow SuSE important heap overflow libpng16

References

* bsc#1254157

* bsc#1254158

* bsc#1254159

* bsc#1254160

* bsc#1254480

Cross-

* CVE-2025-64505

* CVE-2025-64506

* CVE-2025-64720

* CVE-2025-65018

* CVE-2025-66293

CVSS scores:

* CVE-2025-64505 ( SUSE ): 6.9

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2025-64505 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

* CVE-2025-64505 ( NVD ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

* CVE-2025-64506 ( SUSE ): 6.9

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2025-64506 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

* CVE-2025-64506 ( NVD ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

* CVE-2025-64720 ( SUSE ): 6.9

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:20073-1
Release Date: 2026-01-12T11:15:37Z
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow SuSE important heap overflow libpng16

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.