{"schema_version":"1.9.0","id":"CVE-2026-22695","published":"2026-01-12T22:55:40.204Z","modified":"2026-08-12T16:24:50.722867Z","aliases":["GHSA-mmq5-27w3-rxpp"],"related":["ALSA-2026:3405","ALSA-2026:3551","ALSA-2026:4306","ALSA-2026:4728","CGA-m9mc-4gx3-2qq6","SUSE-SU-2026:0192-1","SUSE-SU-2026:0234-1","SUSE-SU-2026:0596-1","SUSE-SU-2026:20127-1","SUSE-SU-2026:20155-1","SUSE-SU-2026:20523-1","SUSE-SU-2026:20530-1","SUSE-SU-2026:23063-1","openSUSE-SU-2026:10060-1","openSUSE-SU-2026:20083-1"],"summary":"LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix)","details":"LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pnggroup/libpng","events":[{"introduced":"49363adcfaf098748d7a4c8c624ad8c45a8c3a86"},{"fixed":"02f2b4f4699f0ef9111a6534f093b53732df4452"},{"fixed":"218612ddd6b17944e21eda56caf8b4bf7779d1ea"},{"fixed":"e4f7ad4ea2"}],"database_specific":{"cpe":"cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.6.51"},{"fixed":"1.6.54"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.6.53","v1.6.52","v1.6.51"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22695.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["327333362595809855009709216293242458091","279773453140246214690474345717570130546","115820707951216701988175577087939699096","311171675743028020374147954611376107950","167668607726485798520722745583647935882","334738595734899256725134661017463305676"],"threshold":0.9},"id":"CVE-2026-22695-010f10be","signature_type":"Line","signature_version":"v1","source":"https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452","target":{"file":"png.c"}},{"deprecated":false,"digest":{"function_hash":"152089211188261457050061368992955969886","length":2018},"id":"CVE-2026-22695-09462e07","signature_type":"Function","signature_version":"v1","source":"https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea","target":{"file":"pngread.c","function":"png_image_finish_read"}},{"deprecated":false,"digest":{"function_hash":"154053324026357579622821123918096375308","length":481},"id":"CVE-2026-22695-13e3a59d","signature_type":"Function","signature_version":"v1","source":"https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452","target":{"file":"png.c","function":"png_get_copyright"}},{"deprecated":false,"digest":{"function_hash":"2333317633844082296990629291887699048","length":5430},"id":"CVE-2026-22695-2ef624d2","signature_type":"Function","signature_version":"v1","source":"https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea","target":{"file":"pngread.c","function":"png_image_read_direct"}},{"deprecated":false,"digest":{"line_hashes":["166375070723291529406421301066248769034","275647010778297936193963675511576832388","256826767335212246520616614652191899280","279336807821086835335477021495116274772","21410732896831932727182998172814220178","106550426482539417114549859700126206902","247197528077876204962072745179511874496","327509478853766906744281300346084898016"],"threshold":0.9},"id":"CVE-2026-22695-3d373722","signature_type":"Line","signature_version":"v1","source":"https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452","target":{"file":"png.h"}},{"deprecated":false,"digest":{"line_hashes":["61817495566730883906655567599472824457","275257476952071577898258900499903171964","91397839701035180686538087820368727519","158625912433874676602721644606842363619"],"threshold":0.9},"id":"CVE-2026-22695-5469271d","signature_type":"Line","signature_version":"v1","source":"https://github.com/pnggroup/libpng/commit/02f2b4f4699f0ef9111a6534f093b53732df4452","target":{"file":"pngtest.c"}},{"deprecated":false,"digest":{"line_hashes":["256497911793156591007313981010137330804","109584513501258957054077128149474560042","192237975258510526477257404003263997624","30606990160421519100275116613142310139","312156519594095370516028297434459873770","220900142416162017220967854775361553404","36118662072103505342061490674230260058","168790125413818935852173291986961269893","120761265379115761546610377133230135172","189089162184373099497428494853543124429","106750596262754699567758987243416013094","226689034820418758914997172041229489211","97224864048706724588862181400610346559","266456732266638609151505188293053155290","203027305669929221271641817633434951738","242739659333768501417776094650324945646","2565877639064083502211329144054449282","334449031200425985162851821346368123662","330775475673055302350346660593795397359","176240222955364160527702469812611380358","11943884251452331759710291842286533529","213920974765294708682054244944584079400","282420276832768553133997784203669148659","328082467098480595943018613690952846180","85407131502103425500873655207900827151","327491415051830615961273482749990703128","215823029670091642558595124854797180422","1689536822304807430628861611239673510","76383076396192905111578340454310377134","262631843307366329793905998192121463093"],"threshold":0.9},"id":"CVE-2026-22695-7c05293a","signature_type":"Line","signature_version":"v1","source":"https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea","target":{"file":"pngread.c"}}],"vanir_signatures_modified":"2026-08-12T16:24:50Z"}}],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22695.json"},{"type":"ADVISORY","url":"https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22695"},{"type":"REPORT","url":"https://github.com/pnggroup/libpng/issues/778"},{"type":"FIX","url":"https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"},{"type":"FIX","url":"https://github.com/pnggroup/libpng/commit/e4f7ad4ea2"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22695.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"}]}