7.1 CVE-2025-65018

Patch Exploit
 

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.
https://nvd.nist.gov/vuln/detail/CVE-2025-65018

Categories

CWE-122 : Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues. Use tools that are integrated duringcompilation to insert runtime error-checking mechanismsrelated to memory safety errors, such as AddressSanitizer(ASan) for C/C++ [REF-1518]. Pre-design: Use a language or compiler that performs automatic bounds checking. Use an abstraction library to abstract away risky APIs. Not a complete solution. Implement and perform bounds checking on input. Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary. Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth. Chain: Javascript engine code does not perform a length check (CWE-1284) leading to integer overflow (CWE-190) causing allocation of smaller buffer than expected (CWE-131) resulting in a heap-based buffer overflow (CWE-122) Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122) Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122) Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122). Chain: machine-learning product can have a heap-basedbuffer overflow (CWE-122) when some integer-oriented bounds arecalculated by using ceiling() and floor() on floating point values(CWE-1339) Chain: integer overflow (CWE-190) causes a negative signed value, which later bypasses a maximum-only check (CWE-839), leading to heap-based buffer overflow (CWE-122).

References


 

CPE

cpe start end
Configuration 1
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* >= 1.6.0 < 1.6.51

REMEDIATION

Patch

Url
https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a4...
https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf777...

EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
https://github.com/Neo-Neo6/CVE-2025-65018-Heap-buffer-overflow-in-libpng-ps4...

Other Nist (github, ...)

Url
https://github.com/pnggroup/libpng/issues/755
https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g
https://github.com/pnggroup/libpng/issues/755
https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
92 Forced Integer Overflow
High