Executive Summary

CVE-2026-22801 is a vulnerability in libpng versions 1.6.26 through 1.6.53 affecting the simplified write API functions png_write_image_16bit and png_write_image_8bit. It is caused by an integer truncation bug where the row stride value (which can be negative or very large) is cast from a signed type to an unsigned 16-bit integer, causing incorrect pointer arithmetic. This leads to heap buffer over-read or infinite loops when the application provides a negative row stride (used for bottom-up image layouts) or a stride exceeding 65,535 bytes. The bug was introduced to silence compiler warnings on 16-bit systems and was fixed in version 1.6.54 by removing the truncating cast and performing arithmetic on the full signed value. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing information disclosure through heap buffer over-read, potentially exposing adjacent heap memory in the output image. It can also cause denial of service due to infinite loops or crashes when reading unmapped memory. Additionally, it may lead to data corruption by writing incorrect image data, although this is not a direct security impact. The attack requires local access to influence the row stride parameter and has low complexity. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying usage of the libpng simplified write API functions (such as png_write_image_16bit, png_write_image_8bit, or png_image_write_to_file) with negative or very large row stride values. Detection involves reviewing application code or binaries for calls to these functions with parameters where the row stride is negative (e.g., for bottom-up image layouts) or exceeds 65535 bytes. Example vulnerable usage includes code snippets like: ptrdiff_t stride = -row_width; // bottom-up layout png_image_write_to_file(&image, "out.png", 0, last_row, stride, NULL); or ptrdiff_t stride = 131072; // very wide 16-bit image png_image_write_to_file(&image, "out.png", 0, buffer, stride, NULL); For testing, running a test program with AddressSanitizer on vulnerable libpng versions (1.6.26 to 1.6.53) can reveal heap buffer over-read or infinite loops. There are no specific network commands since this is a local library vulnerability, but static code analysis or binary scanning for these API calls with problematic stride values is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading libpng to version 1.6.54 or later, where the vulnerability is fixed by removing the truncating cast and correcting pointer arithmetic. If upgrading is not immediately possible, avoid using the simplified write API functions with negative or very large row stride values. Review and modify application code to ensure that row stride parameters are within safe bounds (non-negative and less than or equal to 65535 bytes). Additionally, consider applying patches or backported fixes from libpng 1.6.54 to your current version. Testing with AddressSanitizer can help verify if the vulnerability is still present after mitigation. [1]

Useful 0 Not Useful 0