CVE-2026-25646: 
NixOS vulnerability analysis and mitigation

CVE-2026-25646 is a heap-based buffer overflow and out-of-bounds read vulnerability in the png_set_quantize() API function of libpng, a widely used reference library for reading, creating, and manipulating PNG image files. The flaw exists in all libpng versions prior to 1.6.55 — notably, it has been present since the function was originally introduced as png_set_dither(), making it a decades-old bug. It is triggered when the function is called without a histogram and the palette color count exceeds twice the maximum colors supported by the display, causing an infinite loop that reads past the end of a heap-allocated buffer. The vulnerability was disclosed on February 10, 2026, and fixed in libpng 1.6.55. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a logic error in the color distance hash table population within png_set_quantize() (CWE-122: Heap-based Buffer Overflow; CWE-125: Out-of-bounds Read; CWE-126: Buffer Over-read). The hash table stores current palette indices in each node, but the color-pruning loop assumes original indices and passes them through the index_to_palette lookup table. When colors are eliminated and indices shift, stored indices become stale, causing the pruning loop to find no valid color pairs to eliminate. As a result, the loop's max_d bound increments by 96 each iteration and eventually exceeds 769 — the total size of the hash array — causing reads past the end of the heap-allocated buffer. The fix, committed in 01d03b8, stores original indices via palette_to_index[i] and palette_to_index[j] instead of current indices. Trigger conditions require: an RGB(A) or indexed-color PNG with a PLTE chunk and no hIST chunk, a caller invoking png_set_quantize() with color quantization enabled, and maximum_colors set to less than half the palette size. Crucially, the triggering images are valid per the PNG specification (GitHub Advisory).

Successful exploitation can result in heap memory disclosure (reading sensitive data from adjacent heap regions), denial of service via application crash or infinite loop, and — in the worst case with heap grooming — potential arbitrary code execution. An unauthenticated attacker can deliver a specially crafted PNG image to any application that processes user-supplied images using a vulnerable libpng version, causing the application to hang or crash and potentially leaking heap contents. Given libpng's ubiquity across operating systems, browsers, image editors, and embedded systems, the affected asset scope is extremely broad, spanning millions of applications and devices (GitHub Advisory, eSecurity Planet).

A proof-of-concept (PoC) exploit is publicly available in the libpng GitHub security advisory, including sample trigger PNG images and a C-based PoC program demonstrating the heap-buffer-overflow via AddressSanitizer (GitHub Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.04% (low probability of near-term exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures have been published by Nessus and Qualys scanners across numerous plugin IDs (Red Hat Bugzilla).

1. Craft a malicious PNG image: Create a valid PNG file with an RGB(A) or indexed-color image containing a PLTE chunk (palette) with a large number of colors (e.g., 9 colors) and no hIST (histogram) chunk. The palette size must exceed twice the maximum_colors value that will be passed to png_set_quantize().
2. Identify a vulnerable target application: Find an application that uses libpng < 1.6.55 and calls png_set_quantize() with user-supplied images — such as image viewers, web servers processing uploaded images, or graphics libraries.
3. Deliver the malicious PNG: Submit the crafted PNG to the target application via any available input channel (file upload, network request, email attachment, etc.).
4. Trigger the vulnerable code path: The application calls png_set_quantize(png, palette, num_palette, max_screen_colors, NULL, fq) with max_screen_colors set to less than half of num_palette and no histogram. This triggers the color-pruning loop.
5. Achieve out-of-bounds read: Due to stale palette indices in the hash table, the pruning loop fails to eliminate colors, causing max_d to grow past 769 and the loop to read past the end of the heap-allocated hash array.
6. Exploit outcome: At minimum, the application crashes (DoS). With heap grooming, an attacker may induce an infinite loop via a cyclical hash node, or read/write up to num_palette / 2 bytes past the end of heap buffers, potentially achieving information disclosure or remote code execution (GitHub Advisory).

• File System: Presence of specially crafted PNG files with large PLTE chunks (many palette entries) and no hIST chunk in upload directories, temp folders, or image processing queues.
• Process Behavior: Application processes (image viewers, web servers, media processors) consuming abnormally high CPU or entering infinite loops when processing specific PNG files; unexpected crashes or core dumps in processes linked against libpng.
• Logs: Application crash logs or core dumps referencing png_set_quantize or pngrtran.c; AddressSanitizer reports indicating heap-buffer-overflow at pngrtran.c:723; repeated processing failures for the same PNG file.
• Network: Unusual or repeated uploads of PNG files to image-processing endpoints, particularly files with small dimensions but large palette definitions; network connections dropping unexpectedly after PNG file submission.

The primary remediation is to upgrade libpng to version 1.6.55 or later, which contains the fix committed in 01d03b8. Downstream distributions including Red Hat Enterprise Linux (RHSA-2026:3031 and subsequent advisories), Debian (DSA-6138-1), Ubuntu (USN-8035-1, USN-8039-1), SUSE, Fedora, Slackware, Mageia, Amazon Linux, and Oracle Linux have all released updated packages (Red Hat Bugzilla, Oracle CPU April 2026). As a workaround where patching is not immediately possible, validate and sanitize PNG files before processing — specifically rejecting files with palette sizes exceeding acceptable thresholds or those lacking a histogram chunk when color quantization is used. Applications that do not use the png_set_quantize() API are not affected by this specific vulnerability.

The vulnerability received notable media coverage given its age — described by multiple outlets as a "30-year-old bug" since png_set_quantize() (originally png_set_dither()) has existed since libpng's initial release (CSO Online, eSecurity Planet). Security news outlets including CyberSecurityNews, SecurityOnline, and The Hacker News weekly recap highlighted the flaw's potential RCE risk and broad impact across millions of applications. The libpng maintainer Cosmin Truta co-authored the fix with the reporter Joshua Inscoe (credited as "pwnalone" in the advisory). The vulnerability was also included in Oracle's April 2026 Critical Patch Update affecting Oracle Communications Unified Assurance and in the May 2026 Critical Security Patch Update (Oracle CPU April 2026, Oracle CSPU May 2026).