CVE-2025-28162: 
NixOS vulnerability analysis and mitigation

CVE-2025-28162 is a memory leak vulnerability in libpng versions 1.6.43 through 1.6.46 that allows a local attacker to cause a denial of service. When processing a specially crafted PNG image, the library leaks memory in multiple locations via the png_malloc_base function, eventually leading to high memory usage and application unresponsiveness. The vulnerability was discovered by researcher "kittener" using a fuzzing tool with AddressSanitizer (ASan) and disclosed on January 27, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (libpng Issue #656, CVE Gist).

The vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow), though the actual behavior observed is a memory leak rather than a traditional overflow. Memory allocated via png_malloc_base() in pngmem.c is never freed during error paths in read_png(), specifically during calls to png_create_read_struct() and png_create_info_struct(). ASan traces show leaked allocations across multiple call sites including png_handle_iCCP, png_handle_PLTE, and png_zalloc, totaling over 10,544 bytes across five allocation sites in a single test run. Exploitation requires a local attacker to supply a crafted PNG file to an application using the affected libpng versions (libpng Issue #656, CVE Gist).

Successful exploitation results in progressive memory exhaustion, causing the affected application to become unresponsive or crash, impacting availability only — there is no confidentiality or integrity impact. Any application that processes untrusted PNG files using libpng 1.6.43–1.6.46 is at risk, including image viewers, web browsers, and media processing pipelines. The attack is limited to local access with low privileges, reducing the overall risk, but repeated triggering could destabilize long-running services that process PNG images (libpng Issue #656).

A proof-of-concept (PoC) is publicly available on GitHub, consisting of a crafted PNG file (poc.png) that triggers the memory leak when processed by the pngimage test utility (libpng Issue #656, CVE Gist). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Prepare the crafted PNG: Obtain or create a malicious PNG file (poc.png) that triggers improper memory handling in libpng's png_malloc_base function — a PoC is publicly available on GitHub.
2. Identify a target application: Locate a locally accessible application that uses libpng 1.6.43–1.6.46 to process PNG images (e.g., image viewers, test utilities like pngimage).
3. Supply the malicious PNG: Execute the target application with the crafted PNG as input, e.g., pngimage poc.png.
4. Trigger memory leak: The application processes the PNG, causing allocations in png_malloc_base() that are never freed across multiple code paths (png_create_read_struct, png_create_info_struct, png_handle_iCCP, png_handle_PLTE).
5. Achieve denial of service: Repeated invocations or a single long-running process accumulates leaked memory, eventually causing the application to hang or crash due to resource exhaustion (libpng Issue #656).

• Process Behavior: Applications using libpng exhibiting steadily increasing memory consumption without corresponding release; processes becoming unresponsive when processing PNG files.
• Logs: ASan output (if enabled) showing SUMMARY: AddressSanitizer: X byte(s) leaked in N allocation(s) with stack traces referencing png_malloc_base, png_create_read_struct, or png_create_info_struct.
• File System: Presence of unexpected or externally supplied PNG files in directories processed by libpng-dependent applications.
• System Metrics: Anomalous memory usage spikes in processes that handle PNG image parsing, potentially triggering OOM (out-of-memory) killer events on Linux systems (libpng Issue #656).

Organizations should upgrade libpng to a version beyond 1.6.46, as versions 1.6.43 through 1.6.46 are confirmed affected; no specific patched version number has been formally announced by the libpng project at the time of disclosure. As an interim measure, restrict local user access to systems running affected libpng versions and implement input validation or sandboxing to block untrusted PNG files from reaching libpng-dependent applications. Monitor applications using libpng for unusual memory consumption patterns. Downstream vendors including Ubuntu, SUSE, and Dell have issued advisories and updated packages for their respective distributions (libpng Issue #656).

The vulnerability was reported by researcher "kittener" via the libpng GitHub issue tracker on February 13, 2025, and formally assigned CVE-2025-28162 in January 2026. Multiple Linux distributions including Ubuntu and SUSE issued security advisories addressing the issue, and vendors such as Dell and Splunk published downstream advisories referencing this CVE. Coverage has been limited to security advisory aggregators and Linux security news outlets, with no significant broader media attention given the Medium severity and local-only attack vector (libpng Issue #656).