Detections
Analytics
Alpine: multiple libpng packages: security update to 1.6.54-r0
high Tenable Cloud Security Plugin ID 436903
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the
libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit
output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
This vulnerability is fixed in 1.6.54. (CVE-2026-22695)
- LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable
Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng
simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read
when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535
bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings
on 16-bit systems. This vulnerability is fixed in 1.6.54. (CVE-2026-22801)
See Also
Plugin Details
Severity: High
ID: 436903
Version: Revision 1.6
Type: Local
Published: 1/23/2026
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.95
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-22801
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 1/12/2026
Reference Information
CVE: CVE-2026-22695, CVE-2026-22801
IAVA: 2026-A-0030