Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-64720— LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

Quick assessment

Affected

pnggroup libpng

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libpng是The PNG Development Group开源的一个可对PNG图形文件实现创建、读写等操作的PNG参考库。 libpng 1.6.0版本至1.6.51之前版本存在缓冲区错误漏洞，该漏洞源于png_image_read_composite函数处理调色板图像时存在越界读取，可能导致违反PNG API规范。

CVSS 7.1 · High EPSS 0.45% · P39 Updated Nov 26, 2025

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-64720

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

Source: CVE Program / CVE List V5

Vulnerability Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Vulnerability Title

libpng 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pnggroup	libpng	>= 1.6.0, < 1.6.51	-

II. Public POCs for CVE-2025-64720

#	POC Description	Source Link	Shenlong Link
1	None	https://github.com/truediogo/CVE-2025-64720-PoC	POC Details
2	None	https://github.com/dantsco/CVE-2025-64720-PoC	POC Details

AI-Generated POC Premium

Qwen3.6-35B-A3B · 9000 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2025-64720

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2025-64720

Same Patch Batch · pnggroup · 2025-11-24 · 4 CVEs total

CVE-2025-65018	7.1 HIGH	LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_ima
CVE-2025-64506	6.1 MEDIUM	LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+a
CVE-2025-64505	6.1 MEDIUM	LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette

IV. Related Vulnerabilities

Same product: libpng

Same vendor: pnggroup

Same weakness: CWE-125