CVE-2026-22695: 
NixOS vulnerability analysis and mitigation

CVE-2026-22695 is a heap buffer over-read vulnerability in libpng's simplified API function png_image_finish_read (specifically in png_image_read_direct_scaled) when processing interlaced 16-bit PNG images with 8-bit output format and a non-minimal row stride. It affects libpng versions 1.6.51 through 1.6.53 and is a regression introduced by the fix for CVE-2025-65018 (committed November 19, 2025). The vulnerability was reported on January 6, 2026, and fixed in libpng 1.6.54, released January 12, 2026. It carries a CVSS v3.1 base score of 7.1 (High) per NVD, or 6.1 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Microsoft MSRC).

The root cause (CWE-125: Out-of-bounds Read) lies in the png_image_read_direct_scaled() function introduced by the CVE-2025-65018 fix. This function allocates a local_row intermediate buffer sized to png_get_rowbytes() (the actual transformed row width), but incorrectly uses row_bytes — derived from the caller-supplied row_stride — as the memcpy size parameter. Two exploitation scenarios exist: (1) when row_stride is larger than the actual row width (e.g., for memory alignment padding), memcpy reads past the end of local_row by stride - row_width bytes per row; (2) when row_stride is negative (for bottom-up memory layouts), casting the negative ptrdiff_t to size_t produces a value near 2^64, causing memcpy to attempt reading an enormous amount of heap memory, resulting in a near-certain crash. The fix replaces (size_t)row_bytes with copy_bytes = png_get_rowbytes(png_ptr, info_ptr) in the memcpy call while retaining row_bytes for pointer advancement (GitHub Issue #778, Fix Commit).

Successful exploitation can result in two primary consequences: information disclosure through heap over-read (exposing adjacent heap memory contents such as sensitive application data) and denial of service via application crash (particularly with negative stride values, which cause deterministic crashes due to near-exabyte memcpy attempts). The vulnerability requires user interaction — a victim must open or process a malicious interlaced 16-bit PNG file — and is local in attack vector, limiting its scope. Applications most at risk include image viewers, graphics frameworks, and game engines that use the libpng simplified API with non-default row strides (padded or negative); applications using the default stride (row_stride = 0 or PNG_IMAGE_ROW_STRIDE) are not affected (GitHub Advisory).

Proof-of-concept details and a detailed technical write-up are publicly available via the GitHub issue tracker and security advisory, including a suggested fix and AddressSanitizer-based testing methodology (GitHub Issue #778, GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. Attack complexity is low once a vulnerable application and a crafted PNG are in place, but user interaction is required.

1. Identify a vulnerable target: Find an application that uses the libpng simplified API (png_image_finish_read) with libpng versions 1.6.51–1.6.53, and that passes a non-default row_stride (either padded for alignment or negative for bottom-up layout).
2. Craft a malicious PNG: Create an interlaced 16-bit PNG file (e.g., using ImageMagick: convert -depth 16 -size 32x32 -interlace PNG xc:red malicious.png). The interlaced format is required to trigger the do_local_scale code path.
3. Trigger the vulnerable code path: Deliver the malicious PNG to the target application (e.g., via file upload, email attachment, or web content). The application must open the file using the simplified API with a padded or negative stride.
4. Achieve over-read: With a padded stride, memcpy reads stride - row_width extra bytes per row from adjacent heap memory into the output buffer, potentially exposing sensitive data. With a negative stride, the cast to size_t produces a near-maximal value, causing an immediate crash (DoS).
5. Extract or observe impact: In the padded-stride scenario, the output image buffer may contain leaked heap data (passwords, keys, other in-memory content) that the application subsequently processes or transmits (GitHub Issue #778, GitHub Advisory).

• File System: Presence of crafted interlaced 16-bit PNG files (detectable via PNG chunk inspection: IHDR with bit depth 16 and interlace method 1) in application input directories or temporary folders.
• Process: Application crashes (segmentation faults, access violations) in processes that handle PNG image loading, particularly in functions referencing png_image_finish_read or png_image_read_direct_scaled in stack traces.
• Logs: Application error logs showing crashes or abnormal termination when processing specific PNG files; AddressSanitizer reports of heap-buffer-overflow READ in png_image_read_direct_scaled if instrumented builds are in use.
• Network: Unexpected or anomalous PNG files received via web uploads, email, or other file-transfer mechanisms, especially those with interlaced encoding and 16-bit depth.

The primary remediation is to upgrade libpng to version 1.6.54 or later, which corrects the memcpy size parameter in png_image_read_direct_scaled to use png_get_rowbytes() instead of the caller-supplied stride (Fix Commit, GitHub Advisory). Downstream distributions including Ubuntu (USN-7963-1, USN-8035-1), Debian (DLA-4481-1, DSA-6138-1), Red Hat (RHSA-2026:3405 and others), Fedora, Slackware, Mageia, and Rocky Linux have issued updated packages. As a workaround for systems that cannot be patched immediately, restrict processing of PNG files from untrusted sources and avoid passing non-default (padded or negative) row_stride values to png_image_finish_read. Microsoft has also issued an advisory for affected CBL-Mariner and Azure Linux packages (Microsoft MSRC).

The vulnerability was discussed on the oss-security mailing list shortly after disclosure (oss-sec) and appeared in Reddit's CVEWatch community as a top trending CVE in mid-January 2026. Multiple Linux distribution security teams responded rapidly with patches within days of the libpng 1.6.54 release. The vulnerability was also noted in Huawei's EMUI March 2026 security update and addressed in Dell Secure Connect Gateway and Dell PowerProtect Data Manager advisories, reflecting broad downstream impact across enterprise products.