TLDR Tech / InfoSec
Researchers unearth 30-year-old vulnerability in libpng library
A heap buffer overflow (CVE-2026-25646, CVSS 8.3) in the libpng library, present since its inception nearly 30 years ago, has been patched in version 1.6.55. The flaw lies in the png_set_quantize function, which is used to reduce color in PNG images. Exploitation requires careful heap grooming and crafted-but-valid PNG files, potentially leading to crashes, information leakage, or remote code execution on unpatched systems that use the widely bundled Linux/Unix library. Although the rarely used vulnerable function lowers practical severity, security experts warn that AI-powered bug-hunting tools are accelerating the discovery of similar dormant vulnerabilities across open-source libraries, increasing the risk of threat-actor exploitation before coordinated disclosure.
Read the full story