DEBIAN-CVE-2026-22801
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.
DEBIAN-CVE-2026-22801
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-22801
libpng1.6
Source reference: /affected/0/package/name
- Affected versions
- 1.6.39-2
Source reference:
/affected/0/versions1.6.39-2+deb12u1Source reference:
/affected/0/versions - Fixed versions
- 1.6.39-2+deb12u2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
libpng1.6
Source reference: /affected/1/package/name
- Affected versions
- 1.6.48-1
Source reference:
/affected/1/versions1.6.48-1+deb13u1Source reference:
/affected/1/versions - Fixed versions
- 1.6.48-1+deb13u2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
libpng1.6
Source reference: /affected/2/package/name
- Affected versions
- 1.6.48-1
Source reference:
/affected/2/versions1.6.49-1~exp1Source reference:
/affected/2/versions1.6.50-1Source reference:
/affected/2/versions1.6.50-1~exp1Source reference:
/affected/2/versions1.6.51-1Source reference:
/affected/2/versions1.6.52-1Source reference:
/affected/2/versions1.6.53-1Source reference:
/affected/2/versions - Fixed versions
- 1.6.54-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.39-2+deb12u2"
}
]
}
],
"package": {
"name": "libpng1.6",
"purl": "pkg:deb/debian/libpng1.6?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.6.39-2",
"1.6.39-2+deb12u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22801.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.48-1+deb13u2"
}
]
}
],
"package": {
"name": "libpng1.6",
"purl": "pkg:deb/debian/libpng1.6?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.6.48-1",
"1.6.48-1+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22801.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.54-1"
}
]
}
],
"package": {
"name": "libpng1.6",
"purl": "pkg:deb/debian/libpng1.6?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.6.48-1",
"1.6.49-1~exp1",
"1.6.50-1",
"1.6.50-1~exp1",
"1.6.51-1",
"1.6.52-1",
"1.6.53-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22801.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56216 · Revision 1
- Added to Heist Feed
- Publisher date