png_set_quantize loops for ever on some palettes
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
- Advisory
- CVE-2026-25646
- Library
- libpng, libpng1.6 on Debian
- Published
- Severity
- 8.1 out of 10, as published
- Affected
- libpng before 1.6.55
- Fixed in
- 1.6.55
- Reaches you
- through another call
What triggers it
A libpng caller that asks for quantizing (png_set_quantize) with no histogram, on a palette with more than twice the display's colours; Pillow does not call it.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
Only a caller that requests quantizing reaches it, and Pillow does not. For a caller that does, a scans-only policy without palette PNGs would keep the file away (the png_colour_types setting).
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade to libpng 1.6.55.
Specifically. If your libpng caller quantizes, keep png_colour_types to greyscale and rgb.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2026-25646
- The record entry, triaged 2026-11-03, last checked 2026-11-03