CVE-2025-28164: 
NixOS vulnerability analysis and mitigation

CVE-2025-28164 is a buffer overflow and memory leak vulnerability in libpng versions 1.6.43 through 1.6.46, affecting the png_create_read_struct() function and the underlying png_malloc_base() allocator. Discovered through fuzz testing with AddressSanitizer (ASan) and reported by researcher "kittener" on February 13, 2025, it was publicly disclosed on January 27, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with low privileges required and high availability impact (Feedly, libpng Issue #655).

The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow) and CWE-401 (Missing Release of Memory after Effective Lifetime). During PNG file processing, memory allocated via png_malloc_base() in calls to png_create_read_struct() and png_create_info_struct() is never freed, resulting in direct and indirect memory leaks totaling approximately 2,386 bytes across four allocations in a single test run. The leaked allocations span multiple internal structures including PLTE chunk handling (png_set_PLTE) and text chunk buffers (png_handle_tEXt). A proof-of-concept demonstrating the issue involves running pngimage poc.png against a crafted PNG file with ASan instrumentation enabled (libpng Issue #655, PoC Gist).

Successful exploitation causes a denial of service condition: a local attacker with low privileges can supply a crafted PNG file that triggers unbounded memory growth, eventually causing the affected application to become unresponsive or hang. There is no evidence of confidentiality or integrity impact — the vulnerability is limited to availability. Applications and services that process untrusted PNG files using libpng 1.6.43–1.6.46 are at risk, including image viewers, web servers, and any software embedding libpng as a dependency (Feedly, libpng Issue #655).

A proof-of-concept is publicly available as a GitHub Gist and referenced in the libpng issue tracker, demonstrating the memory leak via a crafted PNG file (PoC Gist). There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term (Feedly).

1. Craft a malicious PNG file: Prepare a PNG file (e.g., poc.png) designed to trigger the memory leak paths in libpng, particularly those involving PLTE and tEXt chunks that exercise png_malloc_base() allocations without corresponding frees.
2. Identify a vulnerable target: Locate a system running an application that uses libpng versions 1.6.43–1.6.46 to process PNG files (e.g., image processing utilities, viewers, or servers).
3. Supply the crafted PNG: As a local user with at least low privileges, provide the crafted poc.png to the target application (e.g., pngimage poc.png).
4. Trigger memory exhaustion: The application calls png_create_read_struct() and png_create_info_struct(), allocating memory via png_malloc_base() that is never released, causing progressive memory growth.
5. Achieve denial of service: With sufficient repeated processing or a sufficiently large/complex PNG, memory usage grows until the application hangs or the system's available memory is exhausted, resulting in a DoS condition (libpng Issue #655, PoC Gist).

• Process Behavior: Applications processing PNG files exhibiting abnormally high and growing memory consumption; processes becoming unresponsive or hanging after PNG file ingestion.
• Logs: Application crash logs or ASan output referencing png_malloc_base, png_create_read_struct, or png_create_info_struct with leak summaries (e.g., SUMMARY: AddressSanitizer: 2386 byte(s) leaked in 4 allocation(s)).
• File System: Presence of crafted PNG files (e.g., files with unusual PLTE or tEXt chunks) in directories processed by libpng-dependent applications.
• System: Out-of-memory (OOM) killer events in system logs (/var/log/syslog, dmesg) associated with PNG-processing applications (libpng Issue #655).

Organizations should upgrade libpng to a version beyond 1.6.46 once a patched release is available from the libpng project. As of the disclosure date, no official patch has been released; the issue remains open in the libpng GitHub tracker (libpng Issue #655). In the interim, restrict access to systems and services that process untrusted PNG files to trusted users only, and monitor memory usage of PNG-processing applications. Linux distribution vendors including Ubuntu and SUSE have issued advisories and may provide patched packages through their security channels (Feedly).

Linux distribution vendors including Ubuntu and SUSE have issued security advisories addressing CVE-2025-28164 alongside related libpng vulnerabilities, and Dell has referenced it in multiple DSA advisories for third-party component updates. Huawei has also included it in wearables and laptop security bulletins. Splunk issued advisories (SVD-2026-0511 and SVD-2026-0512) referencing the vulnerability. Security scanner vendors Tenable (Nessus) and Qualys have added detection plugins for the vulnerability (Feedly).