libpng 1.6.43 to 1.6.46 leaks in png_create_read_struct under a sanitiser
Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.
- Advisory
- CVE-2025-28164
- Library
- libpng, libpng1.6 on Debian
- Published
- Severity
- 5.5 out of 10, as published
- Affected
- libpng 1.6.43 to 1.6.46
- Fixed in
- 1.6.47
- Reaches you
- through another call
What triggers it
Creating read structures repeatedly in a program built with AddressSanitizer; reported against the pngimage test program.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
A resource leak in setup code, reported from a test program under a sanitiser, not a flaw a crafted file triggers; nothing a header shows bears on it.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade to libpng 1.6.47.
Specifically. Not a pre-decode matter: the flaw is in a call that opening a file never makes.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2025-28164
- The record entry, triaged 2026-11-03, last checked 2026-11-03