Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-22801

29
FAUCET Score

CVE-2026-22801 is a high-severity integer truncation vulnerability in libpng versions 1.6.26 through 1.6.53, affecting the png_write_image_16bit and png_write_image_8bit functions. This flaw can lead to a heap buffer over-read when processing PNG images with specific negative or excessively large row strides. With a CVSS score of 7.8, it presents a high risk due to potential for confidentiality, integrity, and availability impacts, though it requires local access and low privileges. Currently, there is no evidence of active exploitation, nor are there public exploit modules available in Metasploit or ExploitDB, despite significant community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.6.26, < 1.6.54CPE matchmatch criteria
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.8MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
2.5
Impact Score
4.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.11%
Probability of exploitation in next 30 days
EPSS Percentile
1.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0011 is in the 8th percentile among its peer group of 17,061 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (29)

microsoftpatch availablevia msrc
Product: 20816-17086Fixed in: 1.6.54-1
microsoftpatch availablevia msrc
Product: 20815-17084Fixed in: 1.6.54-1
microsoftpatch availablevia msrc
Product: cbl2 libpng 1.6.52-1 on CBL Mariner 2.0Fixed in: 1.6.54-1
microsoftpatch availablevia msrc
Product: azl3 libpng 1.6.52-1 on Azure Linux 3.0Fixed in: 1.6.54-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: libpng-2:1.6.37-12.el9_7.2
View patch
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 11 ELSFixed in: java-11-openjdk
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 1.8Fixed in: java-1.8.0-openjdk-portable
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 21Fixed in: java-21-openjdk-portable
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 21Fixed in: java-21-openjdk-portable-rhel7
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 25Fixed in: java-21-openjdk-vanilla
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 25Fixed in: java-25-openjdk-portable
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: java-21-openjdk
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: java-25-openjdk
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: libpng
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 17Fixed in: java-21-openjdk-portable
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: java-17-openjdk
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: java-1.8.0-openjdk
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: java-21-openjdk
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: libpng
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: mingw-libpng
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: java-17-openjdk
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: java-1.8.0-openjdk
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: java-21-openjdk
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: java-25-openjdk
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: rhcos
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 17Fixed in: java-17-openjdk-portable
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 11 ELSFixed in: java-21-openjdk-portable
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 11 ELSFixed in: java-11-openjdk-portable
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: libpng

Vendor Advisories (2)

microsoft2026-Jan/CVE-2026-22801Moderate

LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*

Jan 13, 2026
redhatCVE-2026-22801Moderate

libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API

Jan 12, 2026

References

github.com / pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8
Third Party Advisory