CVE-2026-25646

CVE-2026-25646 is an out-of-bounds read vulnerability in the libpng library, specifically within the png_set_quantize() API function prior to version 1.6.55. This flaw can lead to an infinite loop and read past a heap-allocated buffer when processing specially crafted, yet valid, PNG images. The vulnerability is rated as HIGH severity (CVSS 8.1) with a network attack vector and high attack complexity, potentially leading to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential future interest from threat actors.