CVE-2025-64720

Published Nov 25, 2025

Last updated 9 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-64720 is an out-of-bounds read vulnerability that exists in libpng versions 1.6.0 through 1.6.50. Specifically, the vulnerability occurs in `png_image_read_composite` when processing palette images with `PNG_FLAG_OPTIMIZE_ALPHA` enabled. The issue stems from incorrect background compositing during premultiplication in the palette compositing code within `png_init_read_transformations`. This violates the invariant `component ≤ alpha × 257` required by the simplified PNG API. The vulnerability can be triggered when a victim application uses the simplified API (`png_image_begin_read_from_*` + `png_image_finish_read`) with an alpha-capable format (e.g., `PNG_FORMAT_RGBA`) while processing a crafted PNG image with palette mode and a transparency chunk. This leads to an out-of-bounds access via the `PNG_sRGB_FROM_LINEAR` macro in `png_image_read_composite`.

Description: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.
Source: security-advisories@github.com
NVD status: Analyzed
Products: libpng

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.1
Impact score: 4.2
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-125

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3545FEA5-4FFA-4955-BFDA-CC3602C9A894",
            "versionEndExcluding": "1.6.51",
            "versionStartIncluding": "1.6.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.