RHBA-2026:6267

Vulnerability from csaf_redhat - Published: 2026-03-31 14:40 - Updated: 2026-10-12 00:13
Summary
Red Hat Bug Fix Advisory: OpenJDK 25 FIPS Update for Portable Linux Builds
Severity
Important
Notes
Topic: The FIPS update of OpenJDK 25 for portable Linux builds is now available.
Details: The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. This release of the Red Hat build of OpenJDK 25 (25.0.2) for portable Linux fixes an issue discovered with the new FIPS implementation in OpenJDK 25: * To effectively provide FIPS support, the Red Hat OpenJDK FIPS implementation needs to restrict the operations that security providers can perform. The new implementation of this filtering in OpenJDK 25 proved to be too restrictive and prevented the use of any third-party providers. With this update, we revert to the previous approach of allowing unrestricted third-party providers and trusting the end user to provide due diligence that these do not break FIPS compliance. (OPENJDK-4570) It also updates the bundled versions of libpng and HarfBuzz to their latest versions (1.6.55 & 12.3.2) respectively. Note that crypto policy and FIPS support is not enabled by default on portable Linux builds, because it depends on support provided by Red Hat Enterprise Linux. This functionality is enabled in the RPMs that are provided in Red Hat Enterprise Linux, which use this same portable build. For further information, refer to the release notes linked to in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-66293

An out of bounds read vulnerability has been discovered in libpng. This vulnerability is in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.

7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
Red Hat Build of OpenJDK 25.0.2
Red Hat / OpenJDK
 cpe:/a:redhat:openjdk:25 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-22695

A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 1 product, the same list as for CVE-2025-66293
Threats
Impact Moderate
CVE-2026-22801

A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.

6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 1 product, the same list as for CVE-2025-66293
Threats
Impact Moderate
CVE-2026-25646

A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.

7.0 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 1 product, the same list as for CVE-2025-66293
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHBA-2026:6267 self
https://docs.redhat.com/en/documentation/red_hat_… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-66293 self
https://bugzilla.redhat.com/show_bug.cgi?id=2418711 external
https://www.cve.org/CVERecord?id=CVE-2025-66293 external
https://nvd.nist.gov/vuln/detail/CVE-2025-66293 external
https://github.com/pnggroup/libpng/commit/788a624… external
https://github.com/pnggroup/libpng/commit/a05a48b… external
https://github.com/pnggroup/libpng/issues/764 external
https://github.com/pnggroup/libpng/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-22695 self
https://bugzilla.redhat.com/show_bug.cgi?id=2428825 external
https://www.cve.org/CVERecord?id=CVE-2026-22695 external
https://nvd.nist.gov/vuln/detail/CVE-2026-22695 external
https://github.com/pnggroup/libpng/commit/218612d… external
https://github.com/pnggroup/libpng/commit/e4f7ad4ea2 external
https://github.com/pnggroup/libpng/issues/778 external
https://github.com/pnggroup/libpng/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-22801 self
https://bugzilla.redhat.com/show_bug.cgi?id=2428824 external
https://www.cve.org/CVERecord?id=CVE-2026-22801 external
https://nvd.nist.gov/vuln/detail/CVE-2026-22801 external
https://github.com/pnggroup/libpng/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-25646 self
https://bugzilla.redhat.com/show_bug.cgi?id=2438542 external
https://www.cve.org/CVERecord?id=CVE-2026-25646 external
https://nvd.nist.gov/vuln/detail/CVE-2026-25646 external
http://www.openwall.com/lists/oss-security/2026/02/09/7 external
https://github.com/pnggroup/libpng/commit/01d03b8… external
https://github.com/pnggroup/libpng/security/advis… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The FIPS update of OpenJDK 25 for portable Linux builds is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.\n\nThis release of the Red Hat build of OpenJDK 25 (25.0.2) for portable Linux fixes an issue discovered with the new FIPS implementation in OpenJDK 25:\n\n* To effectively provide FIPS support, the Red Hat OpenJDK FIPS implementation needs to restrict the operations that security providers can perform.  The new implementation of this filtering in OpenJDK 25 proved to be too restrictive and prevented the use of any third-party providers.  With this update, we revert to the previous approach of allowing unrestricted third-party providers and trusting the end user to provide due diligence that these do not break FIPS compliance. (OPENJDK-4570)\n\nIt also updates the bundled versions of libpng and HarfBuzz to their latest versions (1.6.55 \u0026 12.3.2) respectively.\n\nNote that crypto policy and FIPS support is not enabled by default on portable Linux builds, because it depends on support provided by Red Hat Enterprise Linux.  This functionality is enabled in the RPMs that are provided in Red Hat Enterprise Linux, which use this same portable build.\n\nFor further information, refer to the release notes linked to in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2026:6267",
        "url": "https://access.redhat.com/errata/RHBA-2026:6267"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/25/html/release_notes_for_red_hat_build_of_openjdk_25.0.1/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/25/html/release_notes_for_red_hat_build_of_openjdk_25.0.1/index"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_6267.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: OpenJDK 25 FIPS Update for Portable Linux Builds",
    "tracking": {
      "current_release_date": "2026-10-12T00:13:48+00:00",
      "generator": {
        "date": "2026-10-12T00:13:48+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHBA-2026:6267",
      "initial_release_date": "2026-03-31T14:40:00+00:00",
      "revision_history": [
        {
          "date": "2026-03-31T14:40:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-03-31T14:40:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-12T00:13:48+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of OpenJDK 25.0.2",
                "product": {
                  "name": "Red Hat Build of OpenJDK 25.0.2",
                  "product_id": "Red Hat Build of OpenJDK 25.0.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openjdk:25"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenJDK"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-66293",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-12-03T21:00:59.956903+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418711"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out of bounds read vulnerability has been discovered in libpng. This vulnerability is in libpng\u0027s simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng\u0027s internal state management.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: LIBPNG out-of-bounds read in png_image_read_composite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has rated this vulnerability as Important as it affects libpng, a widely used library for PNG image processing. The flaw is due to an out-of-bounds read in libpng\u2019s simplified API when handling specially crafted PNG images containing partial transparency and gamma correction data. Successful exploitation could result in information disclosure or cause application crashes in applications processing untrusted PNG content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 25.0.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66293"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418711",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418711"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66293",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66293"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66293",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66293"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1",
          "url": "https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a",
          "url": "https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/issues/764",
          "url": "https://github.com/pnggroup/libpng/issues/764"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f"
        }
      ],
      "release_date": "2025-12-03T20:33:57.086000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-31T14:40:00+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 25.0.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2026:6267"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 25.0.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 25.0.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libpng: LIBPNG out-of-bounds read in png_image_read_composite"
    },
    {
      "cve": "CVE-2026-22695",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-01-13T00:08:52.403246+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2428825"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. A heap buffer over-read flaw exists in the libpng library when processing specially crafted interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This issue requires user interaction, as an attacker would need to trick a user into opening a malicious PNG file.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 25.0.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-22695"
        },
        {
          "category": "external",
          "summary": "RHBZ#2428825",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-22695",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22695"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
          "url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2",
          "url": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/issues/778",
          "url": "https://github.com/pnggroup/libpng/issues/778"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp"
        }
      ],
      "release_date": "2026-01-12T22:55:40.204000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-31T14:40:00+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 25.0.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2026:6267"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.",
          "product_ids": [
            "Red Hat Build of OpenJDK 25.0.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 25.0.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read"
    },
    {
      "cve": "CVE-2026-22801",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-01-13T00:08:42.581146+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2428824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. An integer truncation flaw in the libpng simplified write API functions (`png_write_image_16bit`, `png_write_image_8bit`) can lead to a heap buffer over-read. Exploitation requires an application to process specially crafted input that provides a negative row stride or a stride exceeding 65535 bytes, potentially resulting in denial of service or information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 25.0.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-22801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2428824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-22801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8"
        }
      ],
      "release_date": "2026-01-12T22:57:58.288000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-31T14:40:00+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 25.0.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2026:6267"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 25.0.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 25.0.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API"
    },
    {
      "cve": "CVE-2026-25646",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-02-10T18:01:28.232408+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2438542"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user\u0027s display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 25.0.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25646"
        },
        {
          "category": "external",
          "summary": "RHBZ#2438542",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25646",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25646"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/02/09/7",
          "url": "http://www.openwall.com/lists/oss-security/2026/02/09/7"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88",
          "url": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88"
        },
        {
          "category": "external",
          "summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3",
          "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3"
        }
      ],
      "release_date": "2026-02-10T17:04:38.501000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-31T14:40:00+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 25.0.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2026:6267"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 25.0.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 25.0.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.