CVE-2025-66293: 
NixOS vulnerability analysis and mitigation

CVE-2025-66293 is an out-of-bounds read vulnerability in libpng's simplified API, specifically in the png_image_read_composite function, that allows reading up to 1,012 bytes beyond the png_sRGB_base[512] array. It affects libpng versions 1.6.0 through 1.6.51 (prior to 1.6.52) and is triggered by processing valid palette PNG images (IHDR color type 3) with partial transparency (tRNS chunk) and gamma correction (gAMA chunk) via the simplified API without an explicit background color. The vulnerability was reported by researcher flyfish101 on November 27, 2025, and publicly disclosed on December 3, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause (CWE-125: Out-of-bounds Read) is a flag synchronization bug in pngrtran.c. In png_init_read_transformations, when processing palette images with gamma correction, libpng performs composition directly on palette entries and then clears the PNG_COMPOSE flag — but critically fails to also clear PNG_FLAG_OPTIMIZE_ALPHA. When the simplified API subsequently calls png_image_read_composite, it sees PNG_FLAG_OPTIMIZE_ALPHA set and assumes pixel data is linear premultiplied (where component <= alpha). However, because png_do_compose never ran, the expanded pixels are in sRGB space, not linear, allowing component values to exceed alpha. The resulting index computation (component * 257*255 + (255-alpha)*png_sRGB_table[...]) can produce an index as high as 1,017 against a 512-entry array, causing a read of up to 1,012 bytes past the buffer boundary into adjacent global data such as png_sRGB_delta[]. Importantly, no malicious PNG crafting is required — any legitimate PNG meeting the trigger conditions (palette + partial tRNS + gAMA + simplified API + non-alpha output format + no background) will trigger the bug (GitHub Advisory, libpng Issue #764).

Successful exploitation can result in information disclosure — specifically, reading up to 1,012 bytes of adjacent global memory (including png_sRGB_delta[] and potentially other globals) — and denial of service if the out-of-bounds read accesses unmapped memory and causes a crash. The vulnerability requires no attacker-controlled input beyond supplying a valid PNG file meeting the trigger conditions, making it exploitable in any application that uses libpng's simplified API to process untrusted PNG images. Downstream products including IBM Netezza Appliance, IBM Cloud Pak for Business Automation, Microsoft Azure Linux packages (libpng, Qt5, TensorFlow, syslinux), Oracle products, Dell NetworkerVProxy, Juniper Secure Analytics, Splunk, and Huawei EMUI are among the affected platforms (GitHub Advisory, Red Hat).

Proof-of-concept code and a crash-reproducing fuzzer harness were published by the reporter (flyfish101) in the libpng GitHub issue tracker, and the vulnerability is referenced on Sploitus. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042% (very low probability of exploitation in the near term). Exploitation requires user interaction in the sense that a user or application must process a triggering PNG file, but no privileges are required and the triggering files are indistinguishable from legitimate PNGs (GitHub Advisory, libpng Issue #764).

1. Craft or obtain a triggering PNG: Create or find a valid PNG file with all of the following properties: palette color type (IHDR color type 3), a tRNS chunk with at least one alpha value between 1 and 254 (partial transparency), and a gAMA chunk with a non-1.0 gamma value. These are common, legitimate PNG properties.
2. Target a vulnerable application: Identify an application using libpng versions 1.6.0–1.6.51 that processes PNG images via the simplified API (png_image_begin_read_from_* / png_image_finish_read) with an output format that does not include alpha (e.g., PNG_FORMAT_RGB) and no explicit background color passed to png_image_finish_read.
3. Deliver the PNG: Supply the triggering PNG to the target application through any available input channel (file upload, URL fetch, email attachment, etc.).
4. Trigger the out-of-bounds read: When the application processes the PNG, png_image_read_composite computes an out-of-range index into png_sRGB_base[], reading up to 1,012 bytes of adjacent global memory.
5. Achieve impact: Depending on memory layout and application behavior, the result is either a crash (denial of service) or silent disclosure of adjacent global data. In ASAN-instrumented builds, the crash is immediately observable as a global-buffer-overflow error (libpng Issue #764, GitHub Advisory).

• Process: Application crashes or abnormal termination when processing specific PNG files; crash dumps referencing png_image_read_composite in pngread.c around line 3279.
• Logs: AddressSanitizer reports of global-buffer-overflow on address near png_sRGB_base in png.c; error messages such as READ of size 2 at ... in png_image_read_composite.
• File System: Presence of PNG files with palette color type, tRNS chunk with partial alpha values (1–254), and gAMA chunk — particularly if sourced from untrusted or unexpected origins.
• Network: Unusual inbound delivery of PNG files to image-processing services or endpoints, especially files that are small but cause disproportionate processing time or crashes (libpng Issue #764).

The primary remediation is to upgrade libpng to version 1.6.52 or later, which includes two commits: a defensive bounds clamp (commit 788a624) and a root-cause flag synchronization fix (commit a05a48b). If immediate upgrade is not possible, the following workarounds can be applied in application code: (1) provide an explicit background color to png_image_finish_read (uses a different code path that avoids the vulnerable function); (2) use the low-level libpng API instead of the simplified API; or (3) request alpha-preserving output formats (e.g., PNG_FORMAT_RGBA) to avoid the composition path. Downstream vendors including Red Hat (RHSA-2026:0125 and others), Debian (DLA-4396-1, DSA-6076-1), Ubuntu (USN-7963-1, USN-8035-1), SUSE, Fedora, Slackware, Amazon Linux, Oracle, IBM, Dell, and Microsoft have released or are releasing updated packages (GitHub Advisory, Red Hat).

The vulnerability was disclosed via the libpng GitHub security advisory and the oss-security mailing list (multiple threads: oss-sec/2025/q4/234, 235, 236) shortly after discovery. Multiple Linux distributions (Debian, Ubuntu, Fedora, SUSE, Slackware, Mageia, Amazon Linux, Rocky Linux, AlmaLinux) responded rapidly with updated packages within days to weeks of disclosure. The CISA vulnerability bulletin for the week of December 1, 2025 included this CVE. Social media activity on Bluesky noted the disclosure. The vulnerability attracted attention partly because it affects valid, non-malicious PNG files and because it was discovered in libpng 1.6.51 — the version that had just patched the related CVE-2025-64720 — highlighting the complexity of the alpha optimization code paths (GitHub Advisory, oss-security).