VDB

RHSA-2026%3A6553

RHSA-2026%3A6553 PUBLISHED CVSS 7 HIGH

A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.

Risk Scores

CVSS 3.1
7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected Products

VendorProductVersions
Red Hatrhcos-x86_64-418.94.202603261158-0 as a component of Red Hat OpenShift Container Platform 4.18418.94.202603261158-0, *
Red Hatrhcos-ppc64le-418.94.202603261158-0 as a component of Red Hat OpenShift Container Platform 4.18rhcos-ppc64le-418.94.202603261158-0, 418.94.202603261158-0
Red Hatrhcos-aarch64-418.94.202603261158-0 as a component of Red Hat OpenShift Container Platform 4.18rhcos-aarch64-418.94.202603261158-0, 418.94.202603261158-0
Red Hatrhcos-s390x-418.94.202603261158-0 as a component of Red Hat OpenShift Container Platform 4.18*, 418.94.202603261158-0

Timeline

  • Apr 9, 2026 CVE Published
  • May 1, 2026 Distribution Patch
  • May 1, 2026 Distribution Patch
  • May 1, 2026 Security Advisory
  • May 1, 2026 Security Advisory
  • May 14, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›