# CVE-2026-25646: mingw32-libpng: MinGW Windows Libpng library.  Security Fix(es):  * libpng: libpng: Information disclosure and denial of service via...

CVE-2026-25646 is fixed in 19 products on 1 platform, first by libpng-tools 1.6.34-1ubuntu0.18.04.2+esm2, released February 10, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-25646
- Priority: High
- CVSS: 8.1 (Important)
- EPSS: 0.0112
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 10, 2026

## Description

MinGW Windows Libpng library.  Security Fix(es):  * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801)  * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695)  * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libpng RHEL 10 | 1.6.40-8.el10_0.2 | [RHSA-2026:3577](https://patchblox.com/security/data/fix/linux/rhsa-2026-3577.md) | Feb 10, 2026 |
| Linux | libpng RHEL 8 | 2:1.6.34-10.el8_10 | [RHSA-2026:4728](https://patchblox.com/security/data/fix/linux/rhsa-2026-4728.md) | Apr 15, 2026 |
| Linux | libpng RHEL 9 | 2:1.6.37-12.el9_7.2 | [RHSA-2026:3405](https://patchblox.com/security/data/fix/linux/rhsa-2026-3405.md) | Mar 12, 2026 |
| Linux | libpng almalinux 10 | 2:1.6.40-8.el10_1.2 | [ALSA-2026:3551](https://patchblox.com/security/data/fix/linux/alsa-2026-3551.md) | Mar 2, 2026 |
| Linux | libpng almalinux 8 | 2:1.6.34-10.el8_10 | [ALSA-2026:4728](https://patchblox.com/security/data/fix/linux/alsa-2026-4728.md) | Mar 17, 2026 |
| Linux | libpng almalinux 9 | 2:1.6.37-12.el9_7.2 | [ALSA-2026:3405](https://patchblox.com/security/data/fix/linux/alsa-2026-3405.md) | Feb 26, 2026 |
| Linux | libpng amzn 2023 | 2:1.6.37-10.amzn2023.0.11 | [ALAS2023-2026-1463](https://patchblox.com/security/data/fix/linux/alas2023-2026-1463.md) | Mar 2, 2026 |
| Linux | libpng ol 10 | 2:1.6.40-8.el10_1.2 | [ELSA-2026-3551](https://patchblox.com/security/data/fix/linux/elsa-2026-3551.md) | Mar 2, 2026 |
| Linux | libpng ol 8 | 2:1.6.34-10.el8_10 | [ELSA-2026-4728](https://patchblox.com/security/data/fix/linux/elsa-2026-4728.md) | Mar 17, 2026 |
| Linux | libpng ol 9 | 2:1.6.37-12.el9_7.2 | [ELSA-2026-3405](https://patchblox.com/security/data/fix/linux/elsa-2026-3405.md) | Feb 26, 2026 |
| Linux | libpng rocky 10 | 2:1.6.40-8.el10_1.2 | [RLSA-2026:3551](https://patchblox.com/security/data/fix/linux/rlsa-2026-3551.md) | Mar 5, 2026 |
| Linux | libpng rocky 8 | 2:1.6.34-10.el8_10 | [RLSA-2026:4728](https://patchblox.com/security/data/fix/linux/rlsa-2026-4728.md) | Mar 18, 2026 |
| Linux | libpng rocky 9 | 2:1.6.37-12.el9_7.2 | [RLSA-2026:3405](https://patchblox.com/security/data/fix/linux/rlsa-2026-3405.md) | Feb 28, 2026 |
| Linux | libpng-debuginfo amzn 2023 | 2:1.6.37-10.amzn2023.0.11 | [ALAS2023-2026-1463](https://patchblox.com/security/data/fix/linux/alas2023-2026-1463.md) | Mar 2, 2026 |
| Linux | libpng-debugsource amzn 2023 | 2:1.6.37-10.amzn2023.0.11 | [ALAS2023-2026-1463](https://patchblox.com/security/data/fix/linux/alas2023-2026-1463.md) | Mar 2, 2026 |
| Linux | libpng-devel RHEL 8 | 2:1.6.34-10.el8_10 | [RHSA-2026:4728](https://patchblox.com/security/data/fix/linux/rhsa-2026-4728.md) | Apr 15, 2026 |
| Linux | libpng-devel RHEL 9 | 2:1.6.37-12.el9_7.2 | [RHSA-2026:3405](https://patchblox.com/security/data/fix/linux/rhsa-2026-3405.md) | Mar 12, 2026 |
| Linux | libpng-devel almalinux 10 | 2:1.6.40-8.el10_1.2 | [ALSA-2026:3551](https://patchblox.com/security/data/fix/linux/alsa-2026-3551.md) | Mar 2, 2026 |
| Linux | libpng-devel almalinux 8 | 2:1.6.34-10.el8_10 | [ALSA-2026:4728](https://patchblox.com/security/data/fix/linux/alsa-2026-4728.md) | Mar 17, 2026 |
| Linux | libpng-devel almalinux 9 | 2:1.6.37-12.el9_7.2 | [ALSA-2026:3405](https://patchblox.com/security/data/fix/linux/alsa-2026-3405.md) | Feb 26, 2026 |
| Linux | libpng-devel amzn 2023 | 2:1.6.37-10.amzn2023.0.11 | [ALAS2023-2026-1463](https://patchblox.com/security/data/fix/linux/alas2023-2026-1463.md) | Mar 2, 2026 |
| Linux | libpng-devel ol 10 | 2:1.6.40-8.el10_1.2 | [ELSA-2026-3551](https://patchblox.com/security/data/fix/linux/elsa-2026-3551.md) | Mar 2, 2026 |
| Linux | libpng-devel ol 8 | 2:1.6.34-10.el8_10 | [ELSA-2026-4728](https://patchblox.com/security/data/fix/linux/elsa-2026-4728.md) | Mar 17, 2026 |
| Linux | libpng-devel ol 9 | 2:1.6.37-12.el9_7.2 | [ELSA-2026-3405](https://patchblox.com/security/data/fix/linux/elsa-2026-3405.md) | Feb 26, 2026 |
| Linux | libpng-devel-debuginfo amzn 2023 | 2:1.6.37-10.amzn2023.0.11 | [ALAS2023-2026-1463](https://patchblox.com/security/data/fix/linux/alas2023-2026-1463.md) | Mar 2, 2026 |
| Linux | libpng-static amzn 2023 | 2:1.6.37-10.amzn2023.0.11 | [ALAS2023-2026-1463](https://patchblox.com/security/data/fix/linux/alas2023-2026-1463.md) | Mar 2, 2026 |
| Linux | libpng-tools Ubuntu 18.04.6 LTS (bionic) | 1.6.34-1ubuntu0.18.04.2+esm2 | [libpng-tools 1.6.34-1ubuntu0.18.04.2+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpng-tools-1.6.34-1ubuntu0.18.04.2-esm2.md) | Feb 10, 2026 |
| Linux | libpng-tools Ubuntu 20.04 LTS (focal) | 1.6.37-2ubuntu0.1~esm2 | [libpng-tools 1.6.37-2ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libpng-tools-1.6.37-2ubuntu0.1-esm2.md) | Feb 10, 2026 |
| Linux | libpng-tools Ubuntu 22.04.1 LTS (jammy) | 1.6.37-3ubuntu0.4 | [libpng-tools 1.6.37-3ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpng-tools-1.6.37-3ubuntu0.4.md) | Feb 10, 2026 |
| Linux | libpng-tools Ubuntu 24.04.5 LTS (noble) | 1.6.43-5ubuntu0.5 | [libpng-tools 1.6.43-5ubuntu0.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpng-tools-1.6.43-5ubuntu0.5.md) | Feb 10, 2026 |
| Linux | libpng-tools Ubuntu 25.10 (questing) | 1.6.50-1ubuntu0.4 | [libpng-tools 1.6.50-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libpng-tools-1.6.50-1ubuntu0.4.md) | Feb 10, 2026 |
| Linux | libpng-tools Ubuntu 26.04.1 LTS (resolute) | 1.6.55-1 | [libpng-tools 1.6.55-1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpng-tools-1.6.55-1.md) | Feb 10, 2026 |
| Linux | libpng-tools amzn 2023 | 2:1.6.37-10.amzn2023.0.11 | [ALAS2023-2026-1463](https://patchblox.com/security/data/fix/linux/alas2023-2026-1463.md) | Mar 2, 2026 |
| Linux | libpng-tools-debuginfo amzn 2023 | 2:1.6.37-10.amzn2023.0.11 | [ALAS2023-2026-1463](https://patchblox.com/security/data/fix/linux/alas2023-2026-1463.md) | Mar 2, 2026 |
| Linux | libpng1.6 Debian 12.15 (bookworm) | 1.6.39-2+deb12u3 | [DSA-6138-1](https://patchblox.com/security/data/fix/linux/dsa-6138-1.md) | Feb 17, 2026 |
| Linux | libpng1.6 Debian 13.5 (trixie) | 1.6.48-1+deb13u3 | [DSA-6138-1](https://patchblox.com/security/data/fix/linux/dsa-6138-1.md) | Feb 17, 2026 |
| Linux | libpng1.6 Debian 14 | 1.6.55-1 | [DEBIAN-CVE-2026-25646](https://patchblox.com/security/data/fix/linux/debian-cve-2026-25646.md) | Feb 10, 2026 |
| Linux | libpng12 RHEL 8 | 0:1.2.57-6.el8_10 | [RHSA-2026:6445](https://patchblox.com/security/data/fix/linux/rhsa-2026-6445.md) | Apr 15, 2026 |
| Linux | libpng12 almalinux 8 | 1.2.57-6.el8_10 | [ALSA-2026:6445](https://patchblox.com/security/data/fix/linux/alsa-2026-6445.md) | Apr 2, 2026 |
| Linux | libpng12 ol 8 | 0:1.2.57-6.el8_10 | [ELSA-2026-6445](https://patchblox.com/security/data/fix/linux/elsa-2026-6445.md) | Apr 2, 2026 |
| Linux | libpng12 opensuse-leap 15.6 | 1.2.57-150000.4.6.1 | [SUSE-SU-2026:0599-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0599-1.md) | Feb 23, 2026 |
| Linux | libpng12 rocky 8 | 0:1.2.57-6.el8_10 | [RLSA-2026:6445](https://patchblox.com/security/data/fix/linux/rlsa-2026-6445.md) | Apr 9, 2026 |
| Linux | libpng12 sles 15.6 | 1.2.57-150000.4.6.1 | [SUSE-SU-2026:0599-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0599-1.md) | Feb 23, 2026 |
| Linux | libpng12 sles 15.7 | 1.2.57-150000.4.6.1 | [SUSE-SU-2026:0599-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0599-1.md) | Feb 23, 2026 |
| Linux | libpng15 RHEL 8 | 0:1.5.30-8.el8_10 | [RHSA-2026:6439](https://patchblox.com/security/data/fix/linux/rhsa-2026-6439.md) | Apr 15, 2026 |
| Linux | libpng15 RHEL 9 | 0:1.5.30-14.el9_7.1 | [RHSA-2026:3031](https://patchblox.com/security/data/fix/linux/rhsa-2026-3031.md) | Mar 12, 2026 |
| Linux | libpng15 almalinux 8 | 1.5.30-8.el8_10 | [ALSA-2026:6439](https://patchblox.com/security/data/fix/linux/alsa-2026-6439.md) | Apr 2, 2026 |
| Linux | libpng15 almalinux 9 | 1.5.30-14.el9_7.1 | [ALSA-2026:3031](https://patchblox.com/security/data/fix/linux/alsa-2026-3031.md) | Feb 23, 2026 |
| Linux | libpng15 ol 8 | 0:1.5.30-8.el8_10 | [ELSA-2026-6439](https://patchblox.com/security/data/fix/linux/elsa-2026-6439.md) | Apr 2, 2026 |
| Linux | libpng15 ol 9 | 0:1.5.30-14.el9_7.1 | [ELSA-2026-3031](https://patchblox.com/security/data/fix/linux/elsa-2026-3031.md) | Feb 23, 2026 |
| Linux | libpng15 rocky 8 | 0:1.5.30-8.el8_10 | [RLSA-2026:6439](https://patchblox.com/security/data/fix/linux/rlsa-2026-6439.md) | Apr 9, 2026 |
| Linux | libpng15 rocky 9 | 0:1.5.30-14.el9_7.1 | [RLSA-2026:3031](https://patchblox.com/security/data/fix/linux/rlsa-2026-3031.md) | Feb 24, 2026 |
| Linux | libpng16 opensuse-leap 15.6 | 1.6.40-150600.3.12.1 | [SUSE-SU-2026:0597-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0597-1.md) | Feb 23, 2026 |
| Linux | libpng16 opensuse-leap 16.0 | 1.6.44-160000.5.1 | [OPENSUSE-SU-2026:20378-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20378-1.md) | Mar 17, 2026 |
| Linux | libpng16 sles 15.6 | 1.6.40-150600.3.12.1 | [SUSE-SU-2026:0597-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0597-1.md) | Feb 23, 2026 |
| Linux | libpng16 sles 15.7 | 1.6.40-150600.3.12.1 | [SUSE-SU-2026:0597-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0597-1.md) | Feb 23, 2026 |
| Linux | libpng16-16 Ubuntu 18.04.6 LTS (bionic) | 1.6.34-1ubuntu0.18.04.2+esm2 | [libpng16-16 1.6.34-1ubuntu0.18.04.2+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpng16-16-1.6.34-1ubuntu0.18.04.2-esm2.md) | Feb 10, 2026 |
| Linux | libpng16-16 Ubuntu 20.04 LTS (focal) | 1.6.37-2ubuntu0.1~esm2 | [libpng16-16 1.6.37-2ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libpng16-16-1.6.37-2ubuntu0.1-esm2.md) | Feb 10, 2026 |
| Linux | libpng16-16 Ubuntu 22.04.1 LTS (jammy) | 1.6.37-3ubuntu0.4 | [libpng16-16 1.6.37-3ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpng16-16-1.6.37-3ubuntu0.4.md) | Feb 10, 2026 |
| Linux | libpng16-16t64 Ubuntu 24.04.5 LTS (noble) | 1.6.43-5ubuntu0.5 | [libpng16-16t64 1.6.43-5ubuntu0.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpng16-16t64-1.6.43-5ubuntu0.5.md) | Feb 10, 2026 |
| Linux | libpng16-16t64 Ubuntu 25.10 (questing) | 1.6.50-1ubuntu0.4 | [libpng16-16t64 1.6.50-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libpng16-16t64-1.6.50-1ubuntu0.4.md) | Feb 10, 2026 |
| Linux | libpng16-16t64 Ubuntu 26.04.1 LTS (resolute) | 1.6.55-1 | [libpng16-16t64 1.6.55-1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpng16-16t64-1.6.55-1.md) | Feb 10, 2026 |
| Linux | mingw-libpng rocky 8 | 0:1.6.34-2.el8_10 | [RLSA-2026:4306](https://patchblox.com/security/data/fix/linux/rlsa-2026-4306.md) | Mar 12, 2026 |
| Linux | mingw32-libpng RHEL 8 | 0:1.6.34-2.el8_10 | [RHSA-2026:4306](https://patchblox.com/security/data/fix/linux/rhsa-2026-4306.md) | Mar 12, 2026 |
| Linux | mingw32-libpng almalinux 8 | 1.6.34-2.el8_10 | [ALSA-2026:4306](https://patchblox.com/security/data/fix/linux/alsa-2026-4306.md) | Mar 11, 2026 |
| Linux | mingw32-libpng ol 8 | 0:1.6.34-2.el8_10 | [ELSA-2026-4306](https://patchblox.com/security/data/fix/linux/elsa-2026-4306.md) | Mar 11, 2026 |
| Linux | mingw32-libpng-static RHEL 8 | 0:1.6.34-2.el8_10 | [RHSA-2026:4306](https://patchblox.com/security/data/fix/linux/rhsa-2026-4306.md) | Mar 12, 2026 |
| Linux | mingw32-libpng-static almalinux 8 | 1.6.34-2.el8_10 | [ALSA-2026:4306](https://patchblox.com/security/data/fix/linux/alsa-2026-4306.md) | Mar 11, 2026 |
| Linux | mingw32-libpng-static ol 8 | 0:1.6.34-2.el8_10 | [ELSA-2026-4306](https://patchblox.com/security/data/fix/linux/elsa-2026-4306.md) | Mar 11, 2026 |
| Linux | mingw64-libpng RHEL 8 | 0:1.6.34-2.el8_10 | [RHSA-2026:4306](https://patchblox.com/security/data/fix/linux/rhsa-2026-4306.md) | Mar 12, 2026 |
| Linux | mingw64-libpng almalinux 8 | 1.6.34-2.el8_10 | [ALSA-2026:4306](https://patchblox.com/security/data/fix/linux/alsa-2026-4306.md) | Mar 11, 2026 |
| Linux | mingw64-libpng ol 8 | 0:1.6.34-2.el8_10 | [ELSA-2026-4306](https://patchblox.com/security/data/fix/linux/elsa-2026-4306.md) | Mar 11, 2026 |
| Linux | mingw64-libpng-static RHEL 8 | 0:1.6.34-2.el8_10 | [RHSA-2026:4306](https://patchblox.com/security/data/fix/linux/rhsa-2026-4306.md) | Mar 12, 2026 |
| Linux | mingw64-libpng-static almalinux 8 | 1.6.34-2.el8_10 | [ALSA-2026:4306](https://patchblox.com/security/data/fix/linux/alsa-2026-4306.md) | Mar 11, 2026 |
| Linux | mingw64-libpng-static ol 8 | 0:1.6.34-2.el8_10 | [ELSA-2026-4306](https://patchblox.com/security/data/fix/linux/elsa-2026-4306.md) | Mar 11, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.