CVE-2025-65018

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

• CWE-122
• CWE-787

• https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4dPatch
• https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1eaPatch
• https://github.com/pnggroup/libpng/issues/755Exploit, Issue Tracking
• https://github.com/pnggroup/libpng/pull/757Issue Tracking
• https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3gExploit, Vendor Advisory
• https://github.com/pnggroup/libpng/issues/755Exploit, Issue Tracking
• https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3gExploit, Vendor Advisory

Published

Nov 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65011In WODESYS WD-R608U router (also known as WDR122B V2.0 and W…7.1
• CVE-2025-65012Kirby is an open-source content management system. From vers…5.4
• CVE-2025-65013LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…6.1
• CVE-2025-65014LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…3.7
• CVE-2025-65015joserfc is a Python library that provides an implementation …7.5
• CVE-2025-65017Decidim is a participatory democracy framework. In versions …6.5
• CVE-2025-65019Astro is a web framework. Prior to version 5.15.9, when usin…6.1
• CVE-2025-6502A vulnerability has been found in code-projects Inventory Ma…9.8
• CVE-2025-65020Rallly is an open-source scheduling and collaboration tool. …6.5
• CVE-2025-65021Rallly is an open-source scheduling and collaboration tool. …9.1
• CVE-2025-65022i-Educar is free, fully online school management software. I…7.2
• CVE-2025-65023i-Educar is free, fully online school management software. I…7.2