libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293

[Cosmin Truta <ctruta () gmail com>]

Hello, everyone,

libpng 1.6.52 has been released to address an out-of-bounds read
vulnerability in the simplified API. This release fixes one
high-severity CVE affecting libpng 1.6.0 through 1.6.51.

CVE-2025-66293 (CVSS 7.1, High): Out-of-bounds read in
png_image_read_composite when processing palette PNG images with
partial transparency and gamma correction.

Note: Unlike typical image parsing vulnerabilities, this bug is
triggered by *valid* PNG files that conform to the PNG specification.
Any palette image with a tRNS chunk containing partial alpha values
(1–254) and a gAMA chunk will trigger the vulnerability when processed
through the simplified API with an output format without alpha and
no explicit background color. The bug is in libpng's internal flag
synchronization, not in the image data.

A flag synchronization bug causes the compositing code to assume
linear premultiplied data when the data is actually sRGB, resulting
in reads up to 1012 bytes past the png_sRGB_base array. This can
result in information disclosure and/or denial of service.

To the best of my knowledge, web browsers use the low-level libpng
API rather than the simplified API, and are not affected by this
vulnerability.

This is distinct from CVE-2025-64720 (fixed in 1.6.51), which also
involved png_sRGB_base but occurred in a different code path and
required a maliciously crafted PNG file to trigger.

GitHub Security Advisory:
- CVE-2025-66293:
https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f

Fixes:
- https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1
- https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a

Release: https://github.com/pnggroup/libpng/releases/tag/v1.6.52

Credit: flyfish101

Users should upgrade to libpng 1.6.52 immediately.

---
Cosmin Truta
libpng maintainer