CVE-2026-25646
Publication date 10 February 2026
Last updated 12 February 2026
Ubuntu priority
Description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libpng | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
|
| firefox | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| thunderbird | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| chromium-browser | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| libpng1.6 | 25.10 questing |
Fixed 1.6.50-1ubuntu0.4
|
| 24.04 LTS noble |
Fixed 1.6.43-5ubuntu0.5
|
|
| 22.04 LTS jammy |
Fixed 1.6.37-3ubuntu0.4
|
|
| 20.04 LTS focal |
Fixed 1.6.37-2ubuntu0.1~esm2
|
|
| 18.04 LTS bionic |
Fixed 1.6.34-1ubuntu0.18.04.2+esm2
|
|
| 16.04 LTS xenial |
Fixed 1.6.20-2ubuntu0.1~esm3
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialReferences
Related Ubuntu Security Notices (USN)
- USN-8035-1
- libpng vulnerabilities
- 12 February 2026
- USN-8039-1
- libpng vulnerability
- 12 February 2026