CVE-2025-28162
📋 TL;DR
A buffer overflow vulnerability in libpng versions 1.6.43 through 1.6.46 allows local attackers to cause denial of service through memory exhaustion. The vulnerability affects applications that process PNG images using these vulnerable libpng versions. This primarily impacts systems where untrusted users can submit PNG files for processing.
💻 Affected Systems
- libpng
- Applications using libpng library
📦 What is this software?
Libpng by Libpng
⚠️ Risk & Real-World Impact
Worst Case
Complete system unresponsiveness due to memory exhaustion, potentially affecting all applications using libpng on the system
Likely Case
Application crashes or becomes unresponsive when processing malicious PNG files, leading to service disruption
If Mitigated
Minimal impact with proper input validation and memory limits in place
🎯 Exploit Status
Exploit requires local access and ability to trigger PNG processing. Proof of concept available in GitHub references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libpng 1.6.47 or later
Vendor Advisory: https://github.com/pnggroup/libpng/issues/656
Restart Required: Yes
Instructions:
1. Update libpng to version 1.6.47 or later. 2. For Linux: Use package manager (apt-get upgrade libpng, yum update libpng, etc.). 3. For Windows: Download updated version from libpng.org. 4. Recompile applications using libpng. 5. Restart affected services.
🔧 Temporary Workarounds
Disable PNG processing
allTemporarily disable PNG image processing in vulnerable applications
Application-specific configuration changes
Implement memory limits
linuxSet memory usage limits for applications using libpng
ulimit -v [memory_limit_in_kb] (Linux)
Set process memory limits via system configuration
🧯 If You Can't Patch
- Implement strict input validation for PNG files
- Isolate applications using libpng in containers with resource limits
🔍 How to Verify
Check if Vulnerable:
Check libpng version: pngcrush -version or check package manager. Versions 1.6.43-1.6.46 are vulnerable.Check Version:
pngcrush -version 2>&1 | grep libpng || dpkg -l | grep libpng || rpm -qa | grep libpngVerify Fix Applied:
Verify libpng version is 1.6.47 or later. Test with known malicious PNG samples.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing PNG files
- High memory usage alerts
- AddressSanitizer error messages
Network Indicators:
- Unusual PNG file uploads to web applications
SIEM Query:
source="application_logs" AND ("libpng" OR "png") AND ("crash" OR "memory" OR "asan")