CVE-2025-28162
Fixed in a distro release EPSS <1%CVSS 5.5
Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive
Products: libpng
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | libpng | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux 2023 | libpng-devel | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux 2023 | libpng-static | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux 2023 | libpng-tools | 2:1.6.37-10.amzn2023.0.10 |
| Debian 12 | libpng1.6 | no fix |
| Debian 13 | libpng1.6 | 1.6.47-1 |
| Debian 14 | libpng1.6 | 1.6.47-1 |
| Red Hat hummingbird 1 | libpng | 0:1.6.56-1.hum1 |
| Red Hat hummingbird 1 | libpng-devel | 0:1.6.56-1.hum1 |
| Red Hat hummingbird 1 | libpng-static | 0:1.6.56-1.hum1 |
| Red Hat hummingbird 1 | libpng-tools | 0:1.6.56-1.hum1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise Micro 5.2 | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise Micro 5.3 | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise Micro 5.4 | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise Micro 5.5 | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | libpng16 | 1.6.40-150600.3.9.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | libpng16 | 1.6.34-150000.3.19.1 |
| SUSE Linux Micro 6.0 | libpng16 | 1.6.43-3.1 |
| SUSE Linux Micro 6.0 | libpng16 | 1.6.58-1.1 |
| SUSE Linux Micro 6.1 | libpng16 | 1.6.43-slfo.1.1_3.1 |
| SUSE Linux Micro 6.1 | libpng16 | 1.6.58-slfo.1.1_1.1 |
| SUSE Linux Micro 6.2 | libpng16 | 1.6.44-160000.5.1 |
| Ubuntu 24.04 LTS | libpng1.6 | 1.6.43-5ubuntu0.4 |
| openSUSE Leap 15.6 | libpng16 | 1.6.40-150600.3.9.1 |
| openSUSE Leap 16.0 | libpng16 | 1.6.44-160000.5.1 |