An interlaced 16-bit PNG overflows a libpng buffer
One of two libpng overflows on the Adam7-interlaced 16-bit path. The upstream record was not re-fetched when this entry was written; see notes.
- Advisory
- CVE-2025-65018 (also GHSA-7wv6-48j4-hj3g)
- Library
- libpng, libpng1.6 on Debian
- Published
- Severity
- 7.1 out of 10, as published
- Affected
- >= 1.6.0, < 1.6.51
- Fixed in
- 1.6.51
- Reaches you
- by opening a file
What triggers it
Opening an Adam7-interlaced PNG with 16-bit samples.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the allow_interlaced_png check.
Interlacing is in the IHDR. No scanner writes an interlaced PNG, so the default refuses one.
Cited from the policy's own notes (policy.py); the OSV record was unreachable when this entry was made and its fields should be filled in.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Keep libpng current.
Specifically. Refuse interlaced PNGs; nothing that scans a page writes one. sillybos does by default.
The general advice applies to every row here.
Sources
- https://github.com/advisories/GHSA-7wv6-48j4-hj3g
- https://osv.dev/vulnerability/CVE-2025-65018
- The record entry, triaged 2026-11-01, last checked 2026-11-01