Overview
CVE-2025-64720 describes an out-of-bounds read vulnerability discovered in libpng, a widely used library for handling PNG image files. This vulnerability affects libpng versions 1.6.0 up to and including 1.6.50. Specifically, the issue resides in the png_image_read_composite function when processing palette images with the PNG_FLAG_OPTIMIZE_ALPHA flag enabled. Successful exploitation of this vulnerability could lead to denial of service or potentially arbitrary code execution.
Technical Details
The vulnerability stems from incorrect handling of background compositing during premultiplication within the palette compositing code in png_init_read_transformations. When PNG_FLAG_OPTIMIZE_ALPHA is active, the code violates the invariant component ≤ alpha × 257, which is required by the simplified PNG API. This violation leads to an out-of-bounds read when the library attempts to access memory locations beyond the allocated buffer, causing a crash or potentially allowing an attacker to control program execution.
Affected versions include all libpng releases from 1.6.0 up to and including 1.6.50.
CVSS Analysis
The National Vulnerability Database (NVD) has assigned CVE-2025-64720 a CVSS score of 7.1, categorizing it as HIGH severity. This score reflects the potential impact of the vulnerability, considering both confidentiality, integrity, and availability.
Possible Impact
Exploitation of CVE-2025-64720 can have several negative consequences:
- Denial of Service (DoS): A malicious PNG image could crash applications using the vulnerable libpng library, rendering them unavailable.
- Information Disclosure: In some scenarios, the out-of-bounds read could expose sensitive information from the application’s memory.
- Remote Code Execution (RCE): While less likely, a sophisticated attacker might be able to leverage the vulnerability to execute arbitrary code on the affected system.
Mitigation and Patch Steps
The recommended mitigation is to upgrade to libpng version 1.6.51 or later. This version contains the necessary patch to address the out-of-bounds read vulnerability. Follow these steps to mitigate the risk:
- Identify Affected Systems: Determine which systems and applications use libpng versions 1.6.0 to 1.6.50.
- Upgrade libpng: Replace the vulnerable libpng library with version 1.6.51 or later. This might involve updating system packages, recompiling applications, or replacing the library file directly.
- Verify the Patch: After upgrading, thoroughly test the affected applications to ensure the patch is effective and that no new issues have been introduced.
