LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8035-1 advisory.

    It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial     transparency and gamma correction. If a user or automated system were tricked into opening a specially     crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of     service. (CVE-2025-66293)

    Petr Simecek, Stanislav Fort and Pavel Kohout discovered that the libpng simplified API incorrectly     processed interlaced 16-bit PNGs with 8-bit output format and non-minimal row strides. If a user or     automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue     to cause libpng to crash, resulting in a denial of service. (CVE-2026-22695)

    Cosmin Truta discovered that the libpng simplified API incorrectly handled invalid row strides. If a user     or automated system were tricked into opening a specially crafted PNG file, an attacker could use this     issue to cause libpng to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04     LTS and Ubuntu 20.04 LTS. (CVE-2026-22801)

    It was discovered that the libpng simplified API incorrectly handled quantizing RGB images. If a user or     automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue     to cause libpng to crash, resulting in a denial of service. (CVE-2026-25646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1390 advisory.

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the     libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit     output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
    This vulnerability is fixed in 1.6.54. (CVE-2026-22695)

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng     simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read     when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535     bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings     on 16-bit systems. This vulnerability is fixed in 1.6.54. (CVE-2026-22801)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20083-1 advisory.

    - CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525).
    - CVE-2026-22801: Fixed integer truncation causing heap buffer over-read in png_image_write_*     (bsc#1256526).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0234-1 advisory.

    - CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525)
    - CVE-2026-22801: Fixed integer truncation causing heap buffer over-read in png_image_write_*     (bsc#1256526).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7963-1 advisory.

    It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial     transparency and gamma correction. If a user or automated system were tricked into opening a specially     crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of     service. (CVE-2025-66293)

    Petr Simecek, Stanislav Fort and Pavel Kohout discovered that the libpng simplified API incorrectly     processed interlaced 16-bit PNGs with 8-bit output format and non-minimal row strides. If a user or     automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue     to cause libpng to crash, resulting in a denial of service. (CVE-2026-22695)

    Cosmin Truta discovered that the libpng simplified API incorrectly handled invalid row strides. If a user     or automated system were tricked into opening a specially crafted PNG file, an attacker could use this     issue to cause libpng to crash, resulting in a denial of service. (CVE-2026-22801)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libpng installed on the remote host is prior to 1.6.54. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-014-01 advisory.

    New libpng packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng     simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read     when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535     bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings     on 16-bit systems. This vulnerability is fixed in 1.6.54. (CVE-2026-22801)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
298896	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libpng vulnerabilities (USN-8035-1)	Nessus	Ubuntu Local Security Checks	high
298132	Amazon Linux 2023 : libpng, libpng-devel, libpng-static (ALAS2023-2026-1390)	Nessus	Amazon Linux Local Security Checks	high
296566	openSUSE 16 Security Update : libpng16 (openSUSE-SU-2026:20083-1)	Nessus	SuSE Local Security Checks	high
296444	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libpng16 (SUSE-SU-2026:0234-1)	Nessus	SuSE Local Security Checks	high
288870	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : libpng vulnerabilities (USN-7963-1)	Nessus	Ubuntu Local Security Checks	high
284669	Slackware Linux 15.0 / current libpng Multiple Vulnerabilities (SSA:2026-014-01)	Nessus	Slackware Local Security Checks	high
282644	Linux Distros Unpatched Vulnerability : CVE-2026-22801	Nessus	Misc.	high

Detections

Analytics

CVE-2026-22801

high

Tenable Plugins

high

high

high

high

high

high

high