{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Google heeft kwetsbaarheden verholpen in Android.\n\nSamsung heeft de voor Samsung mobile devices relevante kwetsbaarheden verholpen in Samsung Mobile.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zichzelf verhoogde rechten toe te kennen, toegang te krijgen tot gevoelige gegevens of willekeurige code uit te voeren.\n\nOnder de verholpen kwetsbaarheden zit een aantal kwetsbaarheden die door Google worden gemarkeerd als \u0027Critical\u0027.\n\nGoogle heeft verder, zoals gebruikelijk, weinig detailinformatie beschikbaar gesteld.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14.\n\nSamsung heeft updates uitgebracht om de voor Samsung relevante kwetsbaarheden te verhelpen in Samsung Mobile devices.\n\nZie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
        "title": "CWE-120"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Buffer Over-read",
        "title": "CWE-126"
      },
      {
        "category": "general",
        "text": "Improper Validation of Array Index",
        "title": "CWE-129"
      },
      {
        "category": "general",
        "text": "Integer Overflow or Wraparound",
        "title": "CWE-190"
      },
      {
        "category": "general",
        "text": "Improper Privilege Management",
        "title": "CWE-269"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Reachable Assertion",
        "title": "CWE-617"
      },
      {
        "category": "general",
        "text": "Protection Mechanism Failure",
        "title": "CWE-693"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Rendered UI Layers or Frames",
        "title": "CWE-1021"
      },
      {
        "category": "general",
        "text": "Improper Validation of Syntactic Correctness of Input",
        "title": "CWE-1286"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2026\u0026month=6"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://source.android.com/docs/security/bulletin/2026/2026-06-01"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Google Android en Samsung Mobile",
    "tracking": {
      "current_release_date": "2026-06-02T08:00:20.751798Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0173",
      "initial_release_date": "2026-06-02T08:00:20.751798Z",
      "revision_history": [
        {
          "date": "2026-06-02T08:00:20.751798Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Android"
          }
        ],
        "category": "vendor",
        "name": "Google"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Mobile Devices"
          }
        ],
        "category": "vendor",
        "name": "Samsung"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22424",
      "notes": [
        {
          "category": "description",
          "text": "Improper input validation in multiple locations can allow users to access images across accounts, potentially leading to local privilege escalation without additional execution privileges, requiring user interaction for exploitation.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-22424 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22424.json"
        }
      ],
      "title": "CVE-2025-22424"
    },
    {
      "cve": "CVE-2025-22426",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in ComputerEngine.java permits unauthorized access to user URIs, enabling local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-22426 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22426.json"
        }
      ],
      "title": "CVE-2025-22426"
    },
    {
      "cve": "CVE-2025-32348",
      "notes": [
        {
          "category": "description",
          "text": "A missing permission check in multiple locations allows background activity launches, potentially enabling local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-32348 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-32348.json"
        }
      ],
      "title": "CVE-2025-32348"
    },
    {
      "cve": "CVE-2025-47384",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "category": "other",
          "text": "Reachable Assertion",
          "title": "CWE-617"
        },
        {
          "category": "description",
          "text": "A transient denial of service (DoS) condition arises when the MAC is configured with a configuration ID exceeding its supported maximum value, causing temporary service disruption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47384 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47384.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47384"
    },
    {
      "cve": "CVE-2025-47392",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "Memory corruption occurs during the decoding of corrupted satellite data files containing invalid signature offsets, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47392 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47392.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47392"
    },
    {
      "cve": "CVE-2025-47400",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A cryptographic vulnerability occurs when data is copied to a destination buffer without verifying the buffer\u0027s size, potentially causing security issues such as buffer overflows.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47400 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47400.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47400"
    },
    {
      "cve": "CVE-2025-47401",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "A transient denial of service vulnerability occurs during the processing of target power rate tables in channel configuration, potentially disrupting normal device operation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47401 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47401.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47401"
    },
    {
      "cve": "CVE-2025-47403",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "A transient denial-of-service condition may occur during wireless roaming when a malformed Fast Transition response frame with an invalid header structure is processed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47403 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47403.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47403"
    },
    {
      "cve": "CVE-2025-48570",
      "notes": [
        {
          "category": "description",
          "text": "PipTaskOrganizer.java contains multiple confused deputy vulnerabilities enabling background activity launches that may lead to local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48570 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48570.json"
        }
      ],
      "title": "CVE-2025-48570"
    },
    {
      "cve": "CVE-2025-48595",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "An integer overflow vulnerability present in multiple locations can enable local privilege escalation without requiring additional execution privileges or user interaction.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48595 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48595.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-48595"
    },
    {
      "cve": "CVE-2025-48615",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "A resource exhaustion issue in getComponentName of MediaButtonReceiverHolder.java may cause desynchronization in persistence, enabling local privilege escalation without user interaction or additional privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48615 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48615.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-48615"
    },
    {
      "cve": "CVE-2025-48649",
      "notes": [
        {
          "category": "description",
          "text": "A permissions bypass vulnerability in multiple locations allows resetting user-selected permissions, potentially enabling local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48649 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48649.json"
        }
      ],
      "title": "CVE-2025-48649"
    },
    {
      "cve": "CVE-2025-48652",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in the performPreInstallChecks function of InstallRepository.kt enables bypassing MDM policy, allowing local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48652 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48652.json"
        }
      ],
      "title": "CVE-2025-48652"
    },
    {
      "cve": "CVE-2025-59604",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "Memory corruption arises during a memory copy operation due to invalid writes triggered by a null pointer dereference, leading to potential instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-59604 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-59604.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-59604"
    },
    {
      "cve": "CVE-2025-59605",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities arise from processing device identifier strings that exceed their expected maximum length, potentially leading to unstable system behavior or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-59605 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-59605.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-59605"
    },
    {
      "cve": "CVE-2025-59606",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "Memory corruption occurs due to heap memory exhaustion during secure data initialization, leading to writes in invalid memory locations.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-59606 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-59606.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-59606"
    },
    {
      "cve": "CVE-2025-64505",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in libpng, including heap buffer over-reads and overflows in functions like png_do_quantize and png_image_read_composite, affect various products such as MySQL Workbench, NetApp, Oracle Hyperion, and Apple Software, potentially causing data disclosure, denial of service, or application crashes.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-64505 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-64505.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-64505"
    },
    {
      "cve": "CVE-2025-64720",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "Libpng versions prior to 1.6.51 contain multiple memory handling vulnerabilities including out-of-bounds reads and buffer overflows in functions like png_image_read_composite, png_do_quantize, and png_combine_row, affecting various products such as MySQL Workbench and NetApp devices.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-64720 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-64720.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-64720"
    },
    {
      "cve": "CVE-2025-65018",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "Multiple heap buffer overflow and out-of-bounds read vulnerabilities exist in libpng versions 1.6.0 to before 1.6.51, affecting functions like png_image_finish_read and png_combine_row, impacting products from Oracle, NetApp, and others.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-65018 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-65018.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-65018"
    },
    {
      "cve": "CVE-2026-0009",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in the code enables tapjacking vulnerabilities at multiple points, allowing local privilege escalation without requiring additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0009 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0009.json"
        }
      ],
      "title": "CVE-2026-0009"
    },
    {
      "cve": "CVE-2026-0016",
      "notes": [
        {
          "category": "description",
          "text": "A permissions bypass vulnerability in CredentialManagerService.java\u0027s updateProvidersWhenServiceRemoved function allows overriding settings across users, potentially leading to local information disclosure without extra privileges or user interaction.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0016 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0016.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0016"
    },
    {
      "cve": "CVE-2026-0018",
      "notes": [
        {
          "category": "description",
          "text": "AccessibilityManagerService.java contains multiple functions with inadequate input validation, leading to a persistent local denial of service without requiring user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0018 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0018.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0018"
    },
    {
      "cve": "CVE-2026-0036",
      "notes": [
        {
          "category": "description",
          "text": "A tapjacking vulnerability in the startAnimation method of StageCoordinator.java enables local privilege escalation without requiring user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0036 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0036.json"
        }
      ],
      "title": "CVE-2026-0036"
    },
    {
      "cve": "CVE-2026-0039",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A remote denial of service vulnerability caused by an integer overflow exists in multiple functions of ubsan_throwing_runtime.cpp, exploitable without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0039 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0039.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0039"
    },
    {
      "cve": "CVE-2026-0040",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0040 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0040.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0040"
    },
    {
      "cve": "CVE-2026-0041",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A potential integer overflow in multiple functions of ubsan_throwing_runtime.cpp can cause a UBSan failure, resulting in a remote denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0041 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0041.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0041"
    },
    {
      "cve": "CVE-2026-0042",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in ubsan_throwing_runtime.cpp functions can lead to a persistent local denial of service via resource exhaustion without requiring user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0042 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0042.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0042"
    },
    {
      "cve": "CVE-2026-0043",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A vulnerability in ubsan_throwing_runtime.cpp involving integer overflow can lead to persistent denial of service and local privilege escalation without requiring user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0043 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0043.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0043"
    },
    {
      "cve": "CVE-2026-0044",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A vulnerability in ubsan_throwing_runtime.cpp involving an integer overflow can cause a system crash, potentially enabling remote denial of service without user interaction or additional privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0044 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0044.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0044"
    },
    {
      "cve": "CVE-2026-0046",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in InputInterceptor of Letterbox.java enables a tapjacking/overlay attack that can trick users into granting permissions, potentially causing local privilege escalation without user interaction or extra execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0046 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0046.json"
        }
      ],
      "title": "CVE-2026-0046"
    },
    {
      "cve": "CVE-2026-0048",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in WindowState.java enables a tapjacking or overlay attack that can deceive users into granting permissions, potentially resulting in local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0048 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0048.json"
        }
      ],
      "title": "CVE-2026-0048"
    },
    {
      "cve": "CVE-2026-0051",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in multiple functions of ubsan_throwing_runtime.cpp allows remote denial of service via improper input validation, exploitable without user interaction or additional privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0051 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0051.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0051"
    },
    {
      "cve": "CVE-2026-0052",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0052 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0052.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0052"
    },
    {
      "cve": "CVE-2026-0055",
      "notes": [
        {
          "category": "description",
          "text": "A path traversal vulnerability in PackageInstallerService.java\u0027s createSessionInternal method allows local privilege escalation by enabling updates to a Device Policy Controller in unauthorized directories without user interaction or extra privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0055 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0055.json"
        }
      ],
      "title": "CVE-2026-0055"
    },
    {
      "cve": "CVE-2026-0056",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "A vulnerability in ResourceTypes.cpp\u0027s setTo function may lead to an out-of-bounds read, potentially causing local information disclosure without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0056 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0056.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0056"
    },
    {
      "cve": "CVE-2026-0059",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in multiple functions of sdp_discovery.cc could enable remote code execution without requiring additional privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0059 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0059.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0059"
    },
    {
      "cve": "CVE-2026-0061",
      "notes": [
        {
          "category": "description",
          "text": "WindowState.java contains multiple functions vulnerable to tapjacking and overlay attacks that can deceive users into granting permissions, enabling local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0061 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0061.json"
        }
      ],
      "title": "CVE-2026-0061"
    },
    {
      "cve": "CVE-2026-0069",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in the verifySignature function of ApkChecksums.java can cause resource exhaustion leading to a crash and local denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0069 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0069.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0069"
    },
    {
      "cve": "CVE-2026-0070",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in DevicePolicyManagerService.java allows hiding a critical system package via improper input validation, enabling a local denial of service without user interaction or additional privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0070 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0070.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0070"
    },
    {
      "cve": "CVE-2026-0076",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability in the validateNode function of ResourceTypes.cpp due to improper bounds checking may enable local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0076 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0076.json"
        }
      ],
      "title": "CVE-2026-0076"
    },
    {
      "cve": "CVE-2026-0077",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in resumeConfigurationDispatch within ActivityRecord.java can trigger background application launches, enabling local privilege escalation without user interaction or elevated execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0077 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0077.json"
        }
      ],
      "title": "CVE-2026-0077"
    },
    {
      "cve": "CVE-2026-0078",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in DevicePolicyManagerService.java\u0027s setGlobalProxy method allows local privilege escalation without user interaction due to improper input validation causing persistence desynchronization.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0078 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0078.json"
        }
      ],
      "title": "CVE-2026-0078"
    },
    {
      "cve": "CVE-2026-0080",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0080 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0080.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0080"
    },
    {
      "cve": "CVE-2026-0087",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in DomainVerificationService.java\u0027s approvalLevelForDomainInternal function enables hijacking of arbitrary app links, leading to local privilege escalation without user interaction or extra execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0087 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0087.json"
        }
      ],
      "title": "CVE-2026-0087"
    },
    {
      "cve": "CVE-2026-0089",
      "notes": [
        {
          "category": "description",
          "text": "A missing permission check in multiple functions of PackageInstallerService.java enables installation of unverified applications, potentially causing local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0089 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0089.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0089"
    },
    {
      "cve": "CVE-2026-0091",
      "notes": [
        {
          "category": "description",
          "text": "An over-privileged shell user in the launcher process enables code execution that results in local privilege escalation without requiring user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0091 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0091.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0091"
    },
    {
      "cve": "CVE-2026-0097",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in multiple locations allows bypassing user interaction during LE device pairing, enabling remote privilege escalation without requiring additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0097 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0097.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0097"
    },
    {
      "cve": "CVE-2026-0100",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in LoadedArsc.cpp can lead to an out-of-bounds write, enabling local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0100 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0100.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0100"
    },
    {
      "cve": "CVE-2026-21017",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in SecTelephonyProvider before SMR Jun-2026 Release 1 allows local attackers to access privileged files due to improper privilege handling.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21017 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21017.json"
        }
      ],
      "title": "CVE-2026-21017"
    },
    {
      "cve": "CVE-2026-21025",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Telephony before SMR Jun-2026 Release 1 allows local attackers to access sensitive information due to incorrect privilege assignment, posing a significant security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21025 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21025.json"
        }
      ],
      "title": "CVE-2026-21025"
    },
    {
      "cve": "CVE-2026-21026",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in SpriteWallpaper before SMR Jun-2026 Release 1 allows local attackers to access sensitive information due to improper export of Android application components.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21026 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21026.json"
        }
      ],
      "title": "CVE-2026-21026"
    },
    {
      "cve": "CVE-2026-21027",
      "notes": [
        {
          "category": "description",
          "text": "An improper export vulnerability in Android\u0027s ImsSettings component before SMR June 2026 Release 1 allows local attackers to trigger the logging function.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21027 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21027.json"
        }
      ],
      "title": "CVE-2026-21027"
    },
    {
      "cve": "CVE-2026-21028",
      "notes": [
        {
          "category": "description",
          "text": "An improper access control vulnerability in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21028 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21028.json"
        }
      ],
      "title": "CVE-2026-21028"
    },
    {
      "cve": "CVE-2026-21029",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Galaxy Editing Service before SMR Jun-2026 Release 1 allows local attackers to perform privileged operations by exploiting improper export of Android application components.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21029 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21029.json"
        }
      ],
      "title": "CVE-2026-21029"
    },
    {
      "cve": "CVE-2026-21030",
      "notes": [
        {
          "category": "description",
          "text": "An improper access control vulnerability in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to execute privileged functions, posing a significant security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21030 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21030.json"
        }
      ],
      "title": "CVE-2026-21030"
    },
    {
      "cve": "CVE-2026-21031",
      "notes": [
        {
          "category": "description",
          "text": "An improper authorization vulnerability in AppBlock before SMR Jun-2026 Release 1 allows a local attacker to launch arbitrary activities, requiring user interaction to exploit.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21031 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21031.json"
        }
      ],
      "title": "CVE-2026-21031"
    },
    {
      "cve": "CVE-2026-21352",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "DNG SDK versions 1.7.1 2410 and earlier have an out-of-bounds write vulnerability that may allow arbitrary code execution when processing malicious files.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21352 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21352.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21352"
    },
    {
      "cve": "CVE-2026-21353",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "DNG SDK versions 1.7.1 2410 and earlier contain an Integer Overflow vulnerability that allows arbitrary code execution when a malicious file is opened.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21353 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21353.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21353"
    },
    {
      "cve": "CVE-2026-21367",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A transient denial of service vulnerability arises from processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial network scans, potentially disrupting normal device operations.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21367 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21367.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21367"
    },
    {
      "cve": "CVE-2026-21372",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities arise from sending IOCTL requests with invalid buffer sizes during memcpy operations, potentially leading to unstable system behavior or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21372 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21372.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21372"
    },
    {
      "cve": "CVE-2026-21373",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities can arise when output buffer sizes are not properly validated during IOCTL processing, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21373 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21373.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21373"
    },
    {
      "cve": "CVE-2026-21374",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A memory corruption vulnerability arises from insufficient buffer size validation during the processing of auxiliary sensor input/output control commands, potentially leading to unstable system behavior.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21374 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21374.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21374"
    },
    {
      "cve": "CVE-2026-21375",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities can arise when output buffer sizes are not properly validated during IOCTL processing, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21375 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21375.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21375"
    },
    {
      "cve": "CVE-2026-21376",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A memory corruption vulnerability exists in a camera sensor driver caused by insufficient validation of output buffer size during IOCTL processing, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21376 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21376.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21376"
    },
    {
      "cve": "CVE-2026-21378",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A memory corruption vulnerability exists in a camera sensor driver caused by insufficient validation of output buffer size during IOCTL processing, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21378 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21378.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21378"
    },
    {
      "cve": "CVE-2026-21380",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities arise from the use of deprecated DMABUF IOCTL calls for video memory management, potentially impacting system stability and security.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21380 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21380.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21380"
    },
    {
      "cve": "CVE-2026-21381",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A transient denial-of-service vulnerability arises when a device processes a service data frame with excessive length during device matching over a Neighborhood Awareness Network protocol connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21381 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21381.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21381"
    },
    {
      "cve": "CVE-2026-21547",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21547 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21547.json"
        }
      ],
      "title": "CVE-2026-21547"
    },
    {
      "cve": "CVE-2026-23787",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-23787 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-23787.json"
        }
      ],
      "title": "CVE-2026-23787"
    },
    {
      "cve": "CVE-2026-24085",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "Memory corruption arises during the processing of display command line information due to an uninitialized variable, potentially leading to unstable system behavior or security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-24085 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24085.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-24085"
    },
    {
      "cve": "CVE-2026-24089",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Syntactic Correctness of Input",
          "title": "CWE-1286"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerability arises from processing fastboot commands with invalid input, potentially leading to unstable system behavior or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-24089 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24089.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-24089"
    },
    {
      "cve": "CVE-2026-25276",
      "cwe": {
        "id": "CWE-129",
        "name": "Improper Validation of Array Index"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Array Index",
          "title": "CWE-129"
        },
        {
          "category": "description",
          "text": "A memory corruption vulnerability arises in Strongbox due to the absence of a bounds check, potentially leading to unstable behavior or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-25276 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25276.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-25276"
    },
    {
      "cve": "CVE-2026-25277",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "A buffer overflow vulnerability in Strongbox leads to memory corruption, potentially compromising system stability and security.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-25277 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25277.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-25277"
    },
    {
      "cve": "CVE-2026-28577",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of Rendered UI Layers or Frames",
          "title": "CWE-1021"
        },
        {
          "category": "description",
          "text": "A tapjacking vulnerability in the addWindow method of WindowManagerService.java enables local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28577 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28577.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28577"
    },
    {
      "cve": "CVE-2026-28578",
      "notes": [
        {
          "category": "description",
          "text": "DevicePolicyManagerService.java contains multiple functions with improper input validation that can cause desynchronization from persistence, potentially resulting in a local denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28578 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28578.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28578"
    },
    {
      "cve": "CVE-2026-28580",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "A bounds check error in multiple functions can cause persistence desynchronization, leading to local privilege escalation without requiring additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28580 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28580.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28580"
    },
    {
      "cve": "CVE-2026-28586",
      "notes": [
        {
          "category": "description",
          "text": "AppOpsService.java contains multiple functions lacking proper permission checks, potentially enabling local information disclosure without user interaction or elevated execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28586 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28586.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28586"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "libpng16-16-1.6.51-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the libpng16-16-1.6.51-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15781",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15781-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64505 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64505/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64506 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64506/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64720 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64720/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-65018 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-65018/"
      }
    ],
    "title": "libpng16-16-1.6.51-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-11-28T00:00:00Z",
      "generator": {
        "date": "2025-11-28T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15781-1",
      "initial_release_date": "2025-11-28T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-11-28T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpng16-16-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-16-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-16-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-32bit-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-16-32bit-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-16-32bit-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-16-x86-64-v3-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-compat-devel-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-compat-devel-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-compat-devel-32bit-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-devel-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-devel-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-32bit-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-devel-32bit-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-devel-32bit-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-tools-1.6.51-1.1.aarch64",
                "product": {
                  "name": "libpng16-tools-1.6.51-1.1.aarch64",
                  "product_id": "libpng16-tools-1.6.51-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpng16-16-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-16-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-16-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-32bit-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-16-32bit-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-16-32bit-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-compat-devel-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-compat-devel-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-devel-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-devel-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-32bit-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-devel-32bit-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-devel-32bit-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-tools-1.6.51-1.1.ppc64le",
                "product": {
                  "name": "libpng16-tools-1.6.51-1.1.ppc64le",
                  "product_id": "libpng16-tools-1.6.51-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpng16-16-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-16-1.6.51-1.1.s390x",
                  "product_id": "libpng16-16-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-32bit-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-16-32bit-1.6.51-1.1.s390x",
                  "product_id": "libpng16-16-32bit-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
                  "product_id": "libpng16-16-x86-64-v3-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-compat-devel-1.6.51-1.1.s390x",
                  "product_id": "libpng16-compat-devel-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
                  "product_id": "libpng16-compat-devel-32bit-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
                  "product_id": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-devel-1.6.51-1.1.s390x",
                  "product_id": "libpng16-devel-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-32bit-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-devel-32bit-1.6.51-1.1.s390x",
                  "product_id": "libpng16-devel-32bit-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
                  "product_id": "libpng16-devel-x86-64-v3-1.6.51-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-tools-1.6.51-1.1.s390x",
                "product": {
                  "name": "libpng16-tools-1.6.51-1.1.s390x",
                  "product_id": "libpng16-tools-1.6.51-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpng16-16-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-16-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-16-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-32bit-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-16-32bit-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-16-32bit-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-16-x86-64-v3-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-compat-devel-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-compat-devel-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-compat-devel-32bit-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-devel-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-devel-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-32bit-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-devel-32bit-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-devel-32bit-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-tools-1.6.51-1.1.x86_64",
                "product": {
                  "name": "libpng16-tools-1.6.51-1.1.x86_64",
                  "product_id": "libpng16-tools-1.6.51-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-16-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-16-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-16-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-16-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-32bit-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-16-32bit-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-32bit-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-16-32bit-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-32bit-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-16-32bit-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-32bit-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-16-32bit-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-x86-64-v3-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-x86-64-v3-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-x86-64-v3-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-compat-devel-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-compat-devel-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-compat-devel-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-compat-devel-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-32bit-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-32bit-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-32bit-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-devel-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-devel-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-devel-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-devel-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-32bit-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-devel-32bit-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-32bit-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-devel-32bit-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-32bit-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-devel-32bit-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-32bit-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-devel-32bit-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-tools-1.6.51-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64"
        },
        "product_reference": "libpng16-tools-1.6.51-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-tools-1.6.51-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le"
        },
        "product_reference": "libpng16-tools-1.6.51-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-tools-1.6.51-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x"
        },
        "product_reference": "libpng16-tools-1.6.51-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-tools-1.6.51-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
        },
        "product_reference": "libpng16-tools-1.6.51-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-64505",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64505"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng\u0027s png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64505",
          "url": "https://www.suse.com/security/cve/CVE-2025-64505"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254157 for CVE-2025-64505",
          "url": "https://bugzilla.suse.com/1254157"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-64505"
    },
    {
      "cve": "CVE-2025-64506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng\u0027s png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64506",
          "url": "https://www.suse.com/security/cve/CVE-2025-64506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254158 for CVE-2025-64506",
          "url": "https://bugzilla.suse.com/1254158"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-64506"
    },
    {
      "cve": "CVE-2025-64720",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64720"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component \u2264 alpha x 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64720",
          "url": "https://www.suse.com/security/cve/CVE-2025-64720"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254159 for CVE-2025-64720",
          "url": "https://bugzilla.suse.com/1254159"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-64720"
    },
    {
      "cve": "CVE-2025-65018",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-65018"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
          "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-65018",
          "url": "https://www.suse.com/security/cve/CVE-2025-65018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254160 for CVE-2025-65018",
          "url": "https://bugzilla.suse.com/1254160"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-16-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-compat-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-32bit-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-devel-x86-64-v3-1.6.51-1.1.x86_64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.aarch64",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.ppc64le",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.s390x",
            "openSUSE Tumbleweed:libpng16-tools-1.6.51-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-65018"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for libpng16",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for libpng16 fixes the following issues:\n\n- CVE-2025-64505: heap buffer over-read in `png_do_quantize` when processing PNG files malformed palette indices\n  (bsc#1254157).\n- CVE-2025-64506: heap buffer over-read in `png_write_image_8bit` when processing 8-bit input with `convert_to_8bit`\n  enabled (bsc#1254158).\n- CVE-2025-64720: out-of-bounds read in `png_image_read_composite` when processing palette images with\n  `PNG_FLAG_OPTIMIZE_ALPHA` enabled (bsc#1254159).\n- CVE-2025-65018: heap buffer overflow in `png_image_finish_read` when processing specially crafted 16-bit interlaced\n  PNGs with 8-bit output format (bsc#1254160).\n- CVE-2025-66293: out-of-bounds read of the `png_sRGB_base` array when processing palette PNG images with partial\n  transparency and gamma correction (bsc#1254480).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-131",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20017-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254157",
        "url": "https://bugzilla.suse.com/1254157"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254158",
        "url": "https://bugzilla.suse.com/1254158"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254159",
        "url": "https://bugzilla.suse.com/1254159"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254160",
        "url": "https://bugzilla.suse.com/1254160"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254480",
        "url": "https://bugzilla.suse.com/1254480"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64505 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64505/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64506 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64506/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64720 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64720/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-65018 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-65018/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-66293 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-66293/"
      }
    ],
    "title": "Security update for libpng16",
    "tracking": {
      "current_release_date": "2026-01-12T11:14:46Z",
      "generator": {
        "date": "2026-01-12T11:14:46Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20017-1",
      "initial_release_date": "2026-01-12T11:14:46Z",
      "revision_history": [
        {
          "date": "2026-01-12T11:14:46Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpng16-16-1.6.44-160000.3.1.aarch64",
                "product": {
                  "name": "libpng16-16-1.6.44-160000.3.1.aarch64",
                  "product_id": "libpng16-16-1.6.44-160000.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
                "product": {
                  "name": "libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
                  "product_id": "libpng16-compat-devel-1.6.44-160000.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-1.6.44-160000.3.1.aarch64",
                "product": {
                  "name": "libpng16-devel-1.6.44-160000.3.1.aarch64",
                  "product_id": "libpng16-devel-1.6.44-160000.3.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-tools-1.6.44-160000.3.1.aarch64",
                "product": {
                  "name": "libpng16-tools-1.6.44-160000.3.1.aarch64",
                  "product_id": "libpng16-tools-1.6.44-160000.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpng16-16-1.6.44-160000.3.1.ppc64le",
                "product": {
                  "name": "libpng16-16-1.6.44-160000.3.1.ppc64le",
                  "product_id": "libpng16-16-1.6.44-160000.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
                "product": {
                  "name": "libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
                  "product_id": "libpng16-compat-devel-1.6.44-160000.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-1.6.44-160000.3.1.ppc64le",
                "product": {
                  "name": "libpng16-devel-1.6.44-160000.3.1.ppc64le",
                  "product_id": "libpng16-devel-1.6.44-160000.3.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-tools-1.6.44-160000.3.1.ppc64le",
                "product": {
                  "name": "libpng16-tools-1.6.44-160000.3.1.ppc64le",
                  "product_id": "libpng16-tools-1.6.44-160000.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpng16-16-1.6.44-160000.3.1.s390x",
                "product": {
                  "name": "libpng16-16-1.6.44-160000.3.1.s390x",
                  "product_id": "libpng16-16-1.6.44-160000.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-1.6.44-160000.3.1.s390x",
                "product": {
                  "name": "libpng16-compat-devel-1.6.44-160000.3.1.s390x",
                  "product_id": "libpng16-compat-devel-1.6.44-160000.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-1.6.44-160000.3.1.s390x",
                "product": {
                  "name": "libpng16-devel-1.6.44-160000.3.1.s390x",
                  "product_id": "libpng16-devel-1.6.44-160000.3.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-tools-1.6.44-160000.3.1.s390x",
                "product": {
                  "name": "libpng16-tools-1.6.44-160000.3.1.s390x",
                  "product_id": "libpng16-tools-1.6.44-160000.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpng16-16-1.6.44-160000.3.1.x86_64",
                "product": {
                  "name": "libpng16-16-1.6.44-160000.3.1.x86_64",
                  "product_id": "libpng16-16-1.6.44-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
                "product": {
                  "name": "libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
                  "product_id": "libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
                "product": {
                  "name": "libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
                  "product_id": "libpng16-compat-devel-1.6.44-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
                "product": {
                  "name": "libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
                  "product_id": "libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-1.6.44-160000.3.1.x86_64",
                "product": {
                  "name": "libpng16-devel-1.6.44-160000.3.1.x86_64",
                  "product_id": "libpng16-devel-1.6.44-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
                "product": {
                  "name": "libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
                  "product_id": "libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpng16-tools-1.6.44-160000.3.1.x86_64",
                "product": {
                  "name": "libpng16-tools-1.6.44-160000.3.1.x86_64",
                  "product_id": "libpng16-tools-1.6.44-160000.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-1.6.44-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64"
        },
        "product_reference": "libpng16-16-1.6.44-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-1.6.44-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le"
        },
        "product_reference": "libpng16-16-1.6.44-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-1.6.44-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x"
        },
        "product_reference": "libpng16-16-1.6.44-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-1.6.44-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64"
        },
        "product_reference": "libpng16-16-1.6.44-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64"
        },
        "product_reference": "libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-1.6.44-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64"
        },
        "product_reference": "libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-1.6.44-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le"
        },
        "product_reference": "libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-1.6.44-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x"
        },
        "product_reference": "libpng16-compat-devel-1.6.44-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-1.6.44-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64"
        },
        "product_reference": "libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64"
        },
        "product_reference": "libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-1.6.44-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64"
        },
        "product_reference": "libpng16-devel-1.6.44-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-1.6.44-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le"
        },
        "product_reference": "libpng16-devel-1.6.44-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-1.6.44-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x"
        },
        "product_reference": "libpng16-devel-1.6.44-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-1.6.44-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64"
        },
        "product_reference": "libpng16-devel-1.6.44-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64"
        },
        "product_reference": "libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-tools-1.6.44-160000.3.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64"
        },
        "product_reference": "libpng16-tools-1.6.44-160000.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-tools-1.6.44-160000.3.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le"
        },
        "product_reference": "libpng16-tools-1.6.44-160000.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-tools-1.6.44-160000.3.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x"
        },
        "product_reference": "libpng16-tools-1.6.44-160000.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpng16-tools-1.6.44-160000.3.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
        },
        "product_reference": "libpng16-tools-1.6.44-160000.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-64505",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64505"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng\u0027s png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64505",
          "url": "https://www.suse.com/security/cve/CVE-2025-64505"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254157 for CVE-2025-64505",
          "url": "https://bugzilla.suse.com/1254157"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-12T11:14:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-64505"
    },
    {
      "cve": "CVE-2025-64506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng\u0027s png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64506",
          "url": "https://www.suse.com/security/cve/CVE-2025-64506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254158 for CVE-2025-64506",
          "url": "https://bugzilla.suse.com/1254158"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-12T11:14:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-64506"
    },
    {
      "cve": "CVE-2025-64720",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64720"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component \u2264 alpha x 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64720",
          "url": "https://www.suse.com/security/cve/CVE-2025-64720"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254159 for CVE-2025-64720",
          "url": "https://bugzilla.suse.com/1254159"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-12T11:14:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-64720"
    },
    {
      "cve": "CVE-2025-65018",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-65018"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-65018",
          "url": "https://www.suse.com/security/cve/CVE-2025-65018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254160 for CVE-2025-65018",
          "url": "https://bugzilla.suse.com/1254160"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-12T11:14:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-65018"
    },
    {
      "cve": "CVE-2025-66293",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-66293"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng\u0027s simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng\u0027s internal state management. Upgrade to libpng 1.6.52 or later.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
          "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-66293",
          "url": "https://www.suse.com/security/cve/CVE-2025-66293"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254480 for CVE-2025-66293",
          "url": "https://bugzilla.suse.com/1254480"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-16-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-16-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-compat-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-compat-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-devel-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-devel-x86-64-v3-1.6.44-160000.3.1.x86_64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.aarch64",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.ppc64le",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.s390x",
            "openSUSE Leap 16.0:libpng16-tools-1.6.44-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-12T11:14:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-66293"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for mingw-libpng is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "MinGW Windows Libpng library.\n\nSecurity Fix(es):\n\n* libpng: LIBPNG buffer overflow (CVE-2025-64720)\n\n* libpng: LIBPNG heap buffer overflow (CVE-2025-65018)\n\n* libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:0125",
        "url": "https://access.redhat.com/errata/RHSA-2026:0125"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2416904",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416904"
      },
      {
        "category": "external",
        "summary": "2416907",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416907"
      },
      {
        "category": "external",
        "summary": "2418711",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418711"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0125.json"
      }
    ],
    "title": "Red Hat Security Advisory: mingw-libpng security update",
    "tracking": {
      "current_release_date": "2026-06-05T00:33:34+00:00",
      "generator": {
        "date": "2026-06-05T00:33:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2026:0125",
      "initial_release_date": "2026-01-06T11:25:54+00:00",
      "revision_history": [
        {
          "date": "2026-01-06T11:25:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-01-06T11:25:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-05T00:33:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux CRB (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux CRB (v. 8)",
                  "product_id": "CRB-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mingw-libpng-0:1.6.34-1.el8_10.src",
                "product": {
                  "name": "mingw-libpng-0:1.6.34-1.el8_10.src",
                  "product_id": "mingw-libpng-0:1.6.34-1.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mingw-libpng@1.6.34-1.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mingw32-libpng-0:1.6.34-1.el8_10.noarch",
                "product": {
                  "name": "mingw32-libpng-0:1.6.34-1.el8_10.noarch",
                  "product_id": "mingw32-libpng-0:1.6.34-1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mingw32-libpng@1.6.34-1.el8_10?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
                "product": {
                  "name": "mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
                  "product_id": "mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mingw32-libpng-static@1.6.34-1.el8_10?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mingw64-libpng-0:1.6.34-1.el8_10.noarch",
                "product": {
                  "name": "mingw64-libpng-0:1.6.34-1.el8_10.noarch",
                  "product_id": "mingw64-libpng-0:1.6.34-1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mingw64-libpng@1.6.34-1.el8_10?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mingw64-libpng-static-0:1.6.34-1.el8_10.noarch",
                "product": {
                  "name": "mingw64-libpng-static-0:1.6.34-1.el8_10.noarch",
                  "product_id": "mingw64-libpng-static-0:1.6.34-1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mingw64-libpng-static@1.6.34-1.el8_10?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
                "product": {
                  "name": "mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
                  "product_id": "mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mingw32-libpng-debuginfo@1.6.34-1.el8_10?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
                "product": {
                  "name": "mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
                  "product_id": "mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mingw64-libpng-debuginfo@1.6.34-1.el8_10?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mingw-libpng-0:1.6.34-1.el8_10.src as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src"
        },
        "product_reference": "mingw-libpng-0:1.6.34-1.el8_10.src",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mingw32-libpng-0:1.6.34-1.el8_10.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch"
        },
        "product_reference": "mingw32-libpng-0:1.6.34-1.el8_10.noarch",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch"
        },
        "product_reference": "mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mingw32-libpng-static-0:1.6.34-1.el8_10.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch"
        },
        "product_reference": "mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mingw64-libpng-0:1.6.34-1.el8_10.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch"
        },
        "product_reference": "mingw64-libpng-0:1.6.34-1.el8_10.noarch",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch"
        },
        "product_reference": "mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mingw64-libpng-static-0:1.6.34-1.el8_10.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
        },
        "product_reference": "mingw64-libpng-static-0:1.6.34-1.el8_10.noarch",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-64720",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-11-25T00:00:54.081073+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2416904"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw has been discovered in libpng. An out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component \u2264 alpha \u00d7 257 required by the simplified PNG API.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: LIBPNG buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat products. An out-of-bounds read in libpng can occur when processing specially crafted palette images with `PNG_FLAG_OPTIMIZE_ALPHA` enabled. Successful exploitation requires a user to process a malicious PNG file, leading to potential application crash or information disclosure.\n\njava-*-openjdk-headless packages do not contain libsplashscreen.so, hence are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-64720"
        },
        {
          "category": "external",
          "summary": "RHBZ#2416904",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416904"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-64720",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-64720"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-64720",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64720"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643",
          "url": "https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/issues/686",
          "url": "https://github.com/pnggroup/libpng/issues/686"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/pull/751",
          "url": "https://github.com/pnggroup/libpng/pull/751"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww"
        }
      ],
      "release_date": "2025-11-24T23:45:38.315000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-01-06T11:25:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:0125"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libpng: LIBPNG buffer overflow"
    },
    {
      "cve": "CVE-2025-65018",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2025-11-25T00:01:05.570152+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2416907"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw has been discovered in libpng. There is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: LIBPNG heap buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat products. A heap buffer overflow exists in the libpng library\u0027s png_image_finish_read function when processing specially crafted 16-bit interlaced PNG images with an 8-bit output format. Successful exploitation requires a user or an automated system to process a malicious PNG file, which could lead to application crashes or arbitrary code execution.\n\njava-*-openjdk-headless packages do not contain libsplashscreen.so, hence are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-65018"
        },
        {
          "category": "external",
          "summary": "RHBZ#2416907",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416907"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-65018",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-65018"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-65018",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65018"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d",
          "url": "https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
          "url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/issues/755",
          "url": "https://github.com/pnggroup/libpng/issues/755"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/pull/757",
          "url": "https://github.com/pnggroup/libpng/pull/757"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g"
        }
      ],
      "release_date": "2025-11-24T23:50:18.294000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-01-06T11:25:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:0125"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libpng: LIBPNG heap buffer overflow"
    },
    {
      "cve": "CVE-2025-66293",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-12-03T21:00:59.956903+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418711"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out of bounds read vulnerability has been discovered in libpng. This vulnerability is in libpng\u0027s simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng\u0027s internal state management.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: LIBPNG out-of-bounds read in png_image_read_composite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has rated this vulnerability as Important as it affects libpng, a widely used library for PNG image processing. The flaw is due to an out-of-bounds read in libpng\u2019s simplified API when handling specially crafted PNG images containing partial transparency and gamma correction data. Successful exploitation could result in information disclosure or cause application crashes in applications processing untrusted PNG content.\n\nFor `java-17-openjdk-headless` and `java-21-openjdk-headless`, while the affected code is present in the bundled sources, it is not exercised by these headless packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
          "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66293"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418711",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418711"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66293",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66293"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66293",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66293"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1",
          "url": "https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a",
          "url": "https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/issues/764",
          "url": "https://github.com/pnggroup/libpng/issues/764"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f"
        }
      ],
      "release_date": "2025-12-03T20:33:57.086000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-01-06T11:25:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:0125"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CRB-8.10.0.Z.MAIN.EUS:mingw-libpng-0:1.6.34-1.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw32-libpng-static-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-debuginfo-0:1.6.34-1.el8_10.noarch",
            "CRB-8.10.0.Z.MAIN.EUS:mingw64-libpng-static-0:1.6.34-1.el8_10.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libpng: LIBPNG out-of-bounds read in png_image_read_composite"
    }
  ]
}