Ubuntu 25.10: Fix for libpng Critical Denial of Service Issue USN-7963-1

ubuntu

January 14, 2026

Several security issues were fixed in libpng.

Summary

Several security issues were fixed in libpng.

Software Description:

- libpng1.6: PNG (Portable Network Graphics) file library

Details:

It was discovered that the libpng simplified API incorrectly processed

palette PNG images with partial transparency and gamma correction. If a

user or automated system were tricked into opening a specially crafted PNG

file, an attacker could use this issue to cause libpng to crash, resulting

in a denial of service. (CVE-2025-66293)

Petr Simecek, Stanislav Fort and Pavel Kohout discovered that the libpng

simplified API incorrectly processed interlaced 16-bit PNGs with 8-bit

output format and non-minimal row strides. If a user or automated system

were tricked into opening a specially crafted PNG file, an attacker could

use this issue to cause libpng to crash, resulting in a denial of service.

(CVE-2026-22695)

Cosmin Truta discovered that the libpng simplified API incorrectly handled

invalid row strides. If a user or automated system were tricked ...

Read the Full Advisory

Topics Covered

security advisory denial of service critical Ubuntu vulnerability libpng

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  libpng16-16t64                  1.6.50-1ubuntu0.3

Ubuntu 25.04
  libpng16-16t64                  1.6.47-1.1ubuntu0.3

Ubuntu 24.04 LTS
  libpng16-16t64                  1.6.43-5ubuntu0.3

Ubuntu 22.04 LTS
  libpng16-16                     1.6.37-3ubuntu0.3

In general, a standard system update will make all the necessary changes.