Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-015468 advisory.

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service     via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually     leading to high memory usage and causing the program to become unresponsive

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0596-1 advisory.

    - CVE-2025-28162: memory leaks when running `pngimage` (bsc#1257364).
    - CVE-2025-28164: memory leaks when running `pngimage` (bsc#1257365).
    - CVE-2026-22695: heap buffer over-read in png_image_finish_read (bsc#1256525).
    - CVE-2026-22801: integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526).
    - CVE-2026-25646: heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1440 advisory.

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service     via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually     leading to high memory usage and causing the program to become unresponsive (CVE-2025-28162)

    Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service     via png_create_read_struct() function. (CVE-2025-28164)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0364-1 advisory.

    - CVE-2025-28162: memory leaks when running `pngimage` (bsc#1257364).
    - CVE-2025-28164: memory leaks when running `pngimage` (bsc#1257365).
    - CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7993-1 advisory.

    It was discovered that libpng incorrectly handled memory when processing certain malformed PNG files. If a     user or automated system were tricked into opening a specially crafted PNG file, an attacker could use     this issue to cause libpng to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service     via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually     leading to high memory usage and causing the program to become unresponsive (CVE-2025-28162)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310889	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng (UTSA-2026-015468)	Nessus	Unity Linux Local Security Checks	medium
299850	SUSE SLES15 Security Update : libpng16 (SUSE-SU-2026:0596-1)	Nessus	SuSE Local Security Checks	high
299550	Amazon Linux 2023 : libpng, libpng-devel, libpng-static (ALAS2023-2026-1440)	Nessus	Amazon Linux Local Security Checks	medium
297833	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libpng16 (SUSE-SU-2026:0364-1)	Nessus	SuSE Local Security Checks	medium
297658	Ubuntu 24.04 LTS : libpng vulnerabilities (USN-7993-1)	Nessus	Ubuntu Local Security Checks	medium
296923	Linux Distros Unpatched Vulnerability : CVE-2025-28162	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-28162

medium

Tenable Plugins

medium

high

medium

medium

medium

medium