CVE-2026-22695

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22695.json"
}

References

Affected packages

Git / github.com/pnggroup/libpng

Affected ranges

Type: GIT
Repo: https://github.com/pnggroup/libpng
Events: Introduced

49363adcfaf098748d7a4c8c624ad8c45a8c3a86

Fixed

02f2b4f4699f0ef9111a6534f093b53732df4452

Affected versions

v1.*

v1.6.51

v1.6.52

v1.6.53

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22695.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "327333362595809855009709216293242458091",
                "279773453140246214690474345717570130546",
                "115820707951216701988175577087939699096",
                "311171675743028020374147954611376107950",
                "167668607726485798520722745583647935882",
                "334738595734899256725134661017463305676"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-22695-010f10be",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "target":  {
            "file":  "png.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "154053324026357579622821123918096375308",
            "length":  481
        },
        "id":  "CVE-2026-22695-13e3a59d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "target":  {
            "file":  "png.c",
            "function":  "png_get_copyright"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "166375070723291529406421301066248769034",
                "275647010778297936193963675511576832388",
                "256826767335212246520616614652191899280",
                "279336807821086835335477021495116274772",
                "21410732896831932727182998172814220178",
                "106550426482539417114549859700126206902",
                "247197528077876204962072745179511874496",
                "327509478853766906744281300346084898016"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-22695-3d373722",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "target":  {
            "file":  "png.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "61817495566730883906655567599472824457",
                "275257476952071577898258900499903171964",
                "91397839701035180686538087820368727519",
                "158625912433874676602721644606842363619"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-22695-5469271d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "target":  {
            "file":  "pngtest.c"
        }
    }
]

vanir_signatures_modified

"2026-05-31T03:35:30Z"