libpng's pngimage test program leaks memory
Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory us...
- Advisory
- CVE-2025-28162
- Library
- libpng, libpng1.6 on Debian
- Published
- Severity
- 5.5 out of 10, as published
- Affected
- libpng 1.6.43 to 1.6.46
- Fixed in
- see the upstream record
- Reaches you
- through a command-line tool
What triggers it
Running the pngimage test program under AddressSanitizer.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
A test program, not the library; no library call opening a file runs it.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade libpng to a version that has the fix; the upstream record names it.
Specifically. Not a pre-decode matter: a command-line tool, not the library, runs the flawed code.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2025-28162
- The record entry, triaged 2026-11-03, last checked 2026-11-03