CVE-2025-64720 - CVE House

Back to Database

Status published High CVE-2025-64720

LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

7.1 CVSS

Vulnerability Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64720

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pnggroup

View All →

LIBPNG has an out-of-bounds read in png_image_read_composite

LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images

LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index

Affected Vendor

pnggroup

View all reports →

Affected Software

libpng

Vulnerable Versions:

>= 1.6.0, < 1.6.51

Timeline

Official Publish: November 24th, 2025

Last Modified: November 25th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1003 OS Credential Dumping

Credential Access

T1552 Unsecured Credentials

Credential Access