Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-p6b5-1ba6-b3f8
Vulnerability ID VCID-p6b5-1ba6-b3f8
Aliases CVE-2025-64506
Summary Multiple vulnerabilities have been discovered in libpng, the worst of which could lead to execution of arbitrary code.
Status Published
Exploitability 0.5
Weighted Severity 5.5
Risk 2.8
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-125 Out-of-bounds Read
System Score Found at
cvssv3 6.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-64506.json
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64506
cvssv3.1 6.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.1 https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821
ssvc Track https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821
cvssv3.1 6.1 https://github.com/pnggroup/libpng/pull/749
ssvc Track https://github.com/pnggroup/libpng/pull/749
cvssv3.1 6.1 https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6
ssvc Track https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-64506.json
https://api.first.org/data/v1/epss?cve=CVE-2025-64506
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64506
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1121218 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121218
2416906 https://bugzilla.redhat.com/show_bug.cgi?id=2416906
2bd84c019c300b78e811743fbcddb67c9d9bf821 https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821
749 https://github.com/pnggroup/libpng/pull/749
GHSA-qpr4-xm66-hww6 https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6
GLSA-202511-06 https://security.gentoo.org/glsa/202511-06
RHSA-2026:6732 https://access.redhat.com/errata/RHSA-2026:6732
USN-7924-1 https://usn.ubuntu.com/7924-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-64506.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-25T19:26:55Z/ Found at https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://github.com/pnggroup/libpng/pull/749
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-25T19:26:55Z/ Found at https://github.com/pnggroup/libpng/pull/749
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-25T19:26:55Z/ Found at https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6
Exploit Prediction Scoring System (EPSS)
Percentile 0.04344
EPSS Score 0.00017
Published At April 24, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:02:00.147311+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202511-06 38.0.0