Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1440 advisory.

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service     via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually     leading to high memory usage and causing the program to become unresponsive (CVE-2025-28162)

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service     via png_create_read_struct() function. (CVE-2025-28164)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0364-1 advisory.

    - CVE-2025-28162: memory leaks when running `pngimage` (bsc#1257364).
    - CVE-2025-28164: memory leaks when running `pngimage` (bsc#1257365).
    - CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7993-1 advisory.

    It was discovered that libpng incorrectly handled memory when processing certain malformed PNG files. If a     user or automated system were tricked into opening a specially crafted PNG file, an attacker could use     this issue to cause libpng to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service     via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually     leading to high memory usage and causing the program to become unresponsive (CVE-2025-28162)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
299550	Amazon Linux 2023 : libpng, libpng-devel, libpng-static (ALAS2023-2026-1440)	Nessus	Amazon Linux Local Security Checks	medium
297833	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libpng16 (SUSE-SU-2026:0364-1)	Nessus	SuSE Local Security Checks	medium
297658	Ubuntu 24.04 LTS : libpng vulnerabilities (USN-7993-1)	Nessus	Ubuntu Local Security Checks	medium
296923	Linux Distros Unpatched Vulnerability : CVE-2025-28162	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-28162

medium

Tenable Plugins

medium

medium

medium

medium