Vulnerability · NVD

CVE-2025-64720

CVE-2025-64720 : high severity (CVSS 7.1). No tracked catalog app is linked to this CVE.

Severity (CVSS): 7.1
Exploitation: 0.4 %
Tracked apps: 0
Still exposed: 0

Published on 2025-11-25

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

EPSS 0.45% exploit very unlikely percentile 39.1%

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

Android Fixed in June 2026 patch level
Windows Server 2025 Fixed in 10.0.26100.32690
Windows Server 2022 (Server Core installation) Fixed in 10.0.20348.5020
Windows Server 2022 Fixed in 10.0.25398.2274
Windows Server 2019 Fixed in 10.0.17763.8644
Windows Server 2016 Fixed in 10.0.14393.9060
Windows 11 26H1 · 2026-H1 Fixed in 10.0.28000.1836
Windows 11 25H2 · 2025-H2 Fixed in 10.0.26200.8246
Windows 11 24H2 · 2024-H2 Fixed in 10.0.26100.8246
Windows 11 23H2 · 2023-H2 Fixed in 10.0.22631.6936
Windows 10 22H2 · 2022-H2 Fixed in 10.0.19045.7184
Windows 10 21H2 · 2021-H2 Fixed in 10.0.19044.7184
Windows 10 1809 · 2018-09 Fixed in 10.0.17763.8644
Windows 10 1607 · 2016-07 Fixed in 10.0.14393.9060

View on NVD ↗ Advisory · github.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM