CVE-2025-28164

A flaw was found in libpng. This buffer overflow vulnerability allows a local attacker to cause a denial of service (DoS) by exploiting the png_create_read_struct() function. This can lead to the affected system becoming unresponsive or crashing.

This is a MODERATE impact vulnerability affecting libpng versions 1.6.43-1.6.46. A local attacker can exploit a buffer overflow in the png_create_read_struct() function, leading to a denial of service. Exploitation requires the attacker to have local access to the system and provide a specially crafted PNG file.

For java-17-openjdk-headless and java-21-openjdk-headless, while the affected code is present in the bundled sources, it is not exercised by these headless packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate the risk of denial of service, users should avoid processing untrusted PNG image files with applications that utilize libpng. Exercise caution when opening or viewing PNG files from unknown or suspicious sources.