CVE-2026-22801: 
NixOS vulnerability analysis and mitigation

CVE-2026-22801 is an integer truncation vulnerability in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit that causes a heap buffer over-read. It affects libpng versions 1.6.26 through 1.6.53, introduced in October 2016 by casts added to silence compiler warnings on 16-bit systems. The bug was identified on January 10, 2026, and fixed in libpng 1.6.54, released January 12, 2026. It carries a CVSS v3.1 base score of 7.8 (High) per Feedly/NVD, though the upstream GitHub advisory scores it 6.8 (Moderate) (GitHub Advisory, Oracle CPU).

The root cause is an unsafe cast in pngwrite.c where a ptrdiff_t value (display->row_bytes) is truncated to png_uint_16 (16-bit unsigned) before pointer arithmetic, classified as CWE-125 (Out-of-bounds Read) and CWE-190 (Integer Overflow or Wraparound). The vulnerable line is: input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));. When a caller provides a negative row stride (for bottom-up image layouts), the signed value wraps to a large positive number (e.g., -1024 becomes 64512), causing the pointer to advance forward instead of backward, resulting in a heap over-read. A stride of -65536 truncates to 0, causing an infinite loop (DoS). Strides exceeding 65535 bytes lose high bits, causing the pointer to stall and re-read the same row. Exploitation requires the attacker to influence the application's row stride parameter passed to the simplified write API (GitHub Advisory).

Successful exploitation can result in information disclosure (heap memory adjacent to the image buffer may be exposed in the output PNG), denial of service via infinite loop or crash from reading unmapped memory, and incorrect image data being written. The vulnerability is locally scoped — an attacker must be able to influence the stride parameter passed to png_image_write_to_* functions, limiting the attack surface to applications that accept user-controlled image layout parameters. No lateral movement or privilege escalation is directly enabled, but heap memory disclosure could expose sensitive data from the process (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to control the row stride parameter passed to the libpng simplified write API, significantly limiting the practical attack surface (GitHub Advisory).

1. Identify a vulnerable target: Find an application using libpng versions 1.6.26–1.6.53 that exposes the simplified write API (png_image_write_to_file or png_image_write_to_memory) and accepts user-influenced row stride parameters (e.g., image converters, graphics frameworks supporting bottom-up BMP-style layouts).
2. Craft a malicious stride value: Prepare a negative stride value (e.g., -(ptrdiff_t)row_width) to trigger bottom-up layout processing, or a stride exceeding 65535 bytes for very wide 16-bit images.
3. Invoke the write API: Call the application with the crafted stride, causing libpng to cast the ptrdiff_t row_bytes to png_uint_16, truncating the value and corrupting pointer arithmetic.
4. Trigger heap over-read: The corrupted pointer advances in the wrong direction or by the wrong amount, reading heap memory beyond the intended buffer. For a stride of -65536, the pointer stalls, causing an infinite loop (DoS).
5. Extract disclosed data: If the application writes the resulting PNG to a file or network stream, the over-read heap contents may appear in the output image data, potentially exposing sensitive in-process memory (GitHub Advisory).

• Process: Abnormal CPU usage or hung processes associated with image processing applications (indicative of the infinite loop DoS scenario with stride = -65536).
• Logs: Application crash logs or AddressSanitizer reports referencing png_write_image_16bit or png_write_image_8bit with heap-buffer-overflow-read errors in pngwrite.c.
• File System: Output PNG files with unexpected or garbled image data, particularly in applications processing bottom-up image layouts or very wide (>65535 bytes/row) 16-bit images.
• Network: Unexpected or malformed PNG data in network streams from applications using libpng's simplified write API with non-standard stride values.

Upgrade libpng to version 1.6.54 or later, which removes the truncating casts and replaces sizeof(png_uint_16) with the literal 2 to preserve correct ptrdiff_t arithmetic. If immediate patching is not possible, implement input validation in the calling application to reject negative stride values and strides exceeding 65535 bytes before passing them to png_image_write_to_* functions. Major Linux distributions including Ubuntu (USN-7963-1, USN-8035-1), Debian (DSA-6138-1, DLA-4481-1), Red Hat (RHSA-2026:3405 and others), Fedora, Slackware, Mageia, and Rocky Linux have released updated packages (GitHub Advisory, Oracle CPU).

The vulnerability was discovered and fixed by Cosmin Truta, the libpng maintainer, during a review of related CVEs in the simplified API (CVE-2025-65018, CVE-2025-66293, CVE-2026-22695). The GitHub advisory notes this is the write-path analog to previously identified read-path vulnerabilities in the same API. The CVE appeared in Reddit's CVEWatch trending lists for January 14–15, 2026, and received coverage from Linux security news aggregators. No significant controversy or major vendor statements beyond standard patch advisories have been observed (GitHub Advisory).