Vulnerability · NVD

CVE-2025-64505

CVE-2025-64505 : medium severity (CVSS 6.1). No tracked catalog app is linked to this CVE.

Severity (CVSS): 6.1
Exploitation: 0.2 %
Tracked apps: 0
Still exposed: 0

Published on 2025-11-25

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.

Attack vector : Local No privileges required

Show raw CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

EPSS 0.21% exploit very unlikely percentile 10.6%

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

Android Fixed in June 2026 patch level
iOS Fixed in 26.4 18.7.7
iPadOS Fixed in 26.4 18.7.7
macOS Fixed in 26.4 15.7.5 14.8.5

View on NVD ↗ Advisory · github.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM