Wind River Support Network

HomeDefectsLIN1021-19675

Fixed

LIN1021-19675 : Security Advisory - libpng - CVE-2025-66293

Created: Dec 3, 2025 Updated: Jun 8, 2026

Resolved Date: Jun 8, 2026

Found In Version: 10.21.20.1

Fix Version: 10.21.20.27

Severity: Standard

Applicable for: Wind River Linux LTS 21

Component/s: Userspace

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

CVEs

CVE-2025-66293