Vulnerability · NVD

CVE-2025-65018

CVE-2025-65018 : high severity (CVSS 7.1). No tracked catalog app is linked to this CVE.

Severity (CVSS): 7.1
Exploitation: 0.3 %
Tracked apps: 0
Still exposed: 0

Published on 2025-11-25

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

Attack vector : Local No privileges required

Show raw CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS 0.28% exploit very unlikely percentile 20.3%

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

Android Fixed in June 2026 patch level
Windows Server 2025 Fixed in 10.0.26100.32690
Windows Server 2022 (Server Core installation) Fixed in 10.0.20348.5020
Windows Server 2022 Fixed in 10.0.25398.2274
Windows Server 2019 Fixed in 10.0.17763.8644
Windows Server 2016 Fixed in 10.0.14393.9060
Windows 11 26H1 · 2026-H1 Fixed in 10.0.28000.1836
Windows 11 25H2 · 2025-H2 Fixed in 10.0.26200.8246
Windows 11 24H2 · 2024-H2 Fixed in 10.0.26100.8246
Windows 11 23H2 · 2023-H2 Fixed in 10.0.22631.6936
Windows 10 22H2 · 2022-H2 Fixed in 10.0.19045.7184
Windows 10 21H2 · 2021-H2 Fixed in 10.0.19044.7184
Windows 10 1809 · 2018-09 Fixed in 10.0.17763.8644
Windows 10 1607 · 2016-07 Fixed in 10.0.14393.9060

View on NVD ↗ Advisory · github.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM