CVE-2026-22695

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function pngimagefinish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22695.json"
}

References

Affected packages

Git / github.com/pnggroup/libpng

Affected ranges

Type: GIT
Repo: https://github.com/pnggroup/libpng
Events: Introduced

49363adcfaf098748d7a4c8c624ad8c45a8c3a86

Fixed

02f2b4f4699f0ef9111a6534f093b53732df4452

Affected versions

v1.*

v1.6.51

v1.6.52

v1.6.53

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "target": {
            "file": "png.c"
        },
        "id": "CVE-2026-22695-010f10be",
        "digest": {
            "line_hashes": [
                "327333362595809855009709216293242458091",
                "279773453140246214690474345717570130546",
                "115820707951216701988175577087939699096",
                "311171675743028020374147954611376107950",
                "167668607726485798520722745583647935882",
                "334738595734899256725134661017463305676"
            ],
            "threshold": 0.9
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "target": {
            "file": "png.c",
            "function": "png_get_copyright"
        },
        "id": "CVE-2026-22695-13e3a59d",
        "digest": {
            "function_hash": "154053324026357579622821123918096375308",
            "length": 481.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "target": {
            "file": "png.h"
        },
        "id": "CVE-2026-22695-3d373722",
        "digest": {
            "line_hashes": [
                "166375070723291529406421301066248769034",
                "275647010778297936193963675511576832388",
                "256826767335212246520616614652191899280",
                "279336807821086835335477021495116274772",
                "21410732896831932727182998172814220178",
                "106550426482539417114549859700126206902",
                "247197528077876204962072745179511874496",
                "327509478853766906744281300346084898016"
            ],
            "threshold": 0.9
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452",
        "target": {
            "file": "pngtest.c"
        },
        "id": "CVE-2026-22695-5469271d",
        "digest": {
            "line_hashes": [
                "61817495566730883906655567599472824457",
                "275257476952071577898258900499903171964",
                "91397839701035180686538087820368727519",
                "158625912433874676602721644606842363619"
            ],
            "threshold": 0.9
        },
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22695.json"

vanir_signatures_modified

"2026-05-31T03:35:30Z"