Off-by-one error in the png_formatted_warning function in pngerror.c in libpng 1.5.4 through 1.5.7 might allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors, which trigger a stack-based buffer overflow.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1653 advisory.

    This advisory aggregates security fixes for the libpng SRPM in CIQ LTS 8.6. It addresses 20 CVEs:
    CVE-2026-22801, CVE-2007-2445, CVE-2007-5269, CVE-2008-1382, CVE-2008-3964, and 15 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1395 advisory.

    This advisory aggregates security fixes for the libpng SRPM in CIQ LTS 9.6. It addresses 21 CVEs:
    CVE-2025-64506, CVE-2019-7317, CVE-2007-2445, CVE-2007-5269, CVE-2008-1382, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1424 advisory.

    This advisory aggregates security fixes for the libpng SRPM in CIQ LTS 9.2. It addresses 31 CVEs:
    CVE-2025-64720, CVE-2025-65018, CVE-2025-66293, CVE-2026-34757, CVE-2025-64505, and 26 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This is an update to MinGW cross compiled libpng 1.5.13, including a fix to CVE-2011-3464.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201206-15 (libpng: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libpng:
      The &ldquo;embedded_profile_len()&rdquo; function in pngwutil.c does not         check for negative values, resulting in a memory leak (CVE-2009-5063).
      The &ldquo;png_format_buffer()&rdquo; function in pngerror.c contains an         off-by-one error (CVE-2011-2501).
      The &ldquo;png_rgb_to_gray()&rdquo; function in pngrtran.c contains an         integer overflow error (CVE-2011-2690).
      The &ldquo;png_err()&rdquo; function in pngerror.c contains a NULL pointer         dereference error (CVE-2011-2691).
      The &ldquo;png_handle_sCAL()&rdquo; function in pngrutil.c improperly handles         malformed sCAL chunks(CVE-2011-2692).
      The &ldquo;png_decompress_chunk()&rdquo; function in pngrutil.c contains an         integer overflow error (CVE-2011-3026).
      The &ldquo;png_inflate()&rdquo; function in pngrutil.c contains and out of         bounds error (CVE-2011-3045).
      The &ldquo;png_set_text_2()&rdquo; function in pngset.c contains an error         which could result in memory corruption (CVE-2011-3048).
      The &ldquo;png_formatted_warning()&rdquo; function in pngerror.c contains an         off-by-one error (CVE-2011-3464).
  Impact :

    An attacker could exploit these vulnerabilities to execute arbitrary       code with the permissions of the user running the vulnerable program,       which could be the root user, or to cause programs linked against the       library to crash.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
369917	Rocky Linux 8.6 [CIQ] Security Update: libpng / libpng-devel Multiple Vulnerabilities (ciqsa-2026_1653)	Nessus	Rocky Linux Local Security Checks	Local	critical
357096	Rocky Linux 9.6 [CIQ] Security Update: libpng / libpng-devel Multiple Vulnerabilities (ciqsa-2026_1395)	Nessus	Rocky Linux Local Security Checks	Local	critical
356085	Rocky Linux 9.2 [CIQ] Security Update: libpng / libpng-devel Multiple Vulnerabilities (ciqsa-2026_1424)	Nessus	Rocky Linux Local Security Checks	Local	high
62645	Fedora 17 : mingw-libpng-1.5.13-1.fc17 (2012-15613)	Nessus	Fedora Local Security Checks	Local	high
62486	Fedora 18 : mingw-libpng-1.5.13-1.fc18 (2012-15592)	Nessus	Fedora Local Security Checks	Local	high
59668	GLSA-201206-15 : libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high

Detections

Analytics

CVE-2011-3464

critical

Tenable Plugins

critical

critical

high

high

high

high