Out-of-range palette indices over-read libpng's quantize table
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
- Advisory
- CVE-2025-64505
- Library
- libpng, libpng1.6 on Debian
- Published
- Severity
- 6.1 out of 10, as published
- Affected
- libpng before 1.6.51
- Fixed in
- 1.6.51
- Reaches you
- through another call
What triggers it
Reading a palette PNG with out-of-range indices through a libpng caller that has asked for quantizing (png_set_quantize); Pillow does not.
What sillybos does
Refused with a setting
sillybos refuses the triggering file when the policy says so (png_colour_types); the default policy lets it through.
A palette PNG. Under a scans-only policy (png_colour_types without palette) the file is refused before libpng sees it; the default policy allows palette PNGs, so the setting is what closes this.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade to libpng 1.6.51.
Specifically. Keep png_colour_types to greyscale and rgb for scans, as the policy table suggests; a scanner never writes a palette image.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2025-64505
- The record entry, triaged 2026-11-03, last checked 2026-11-03