CVE-2025-64720: libpng Buffer Overflow in Palette Premultiplication

Status: Patched
Severity: High
CVE ID: CVE-2025-64720
Discovery Date: 2025-11-XX
Public Disclosure: 2025-11-21

Overview

Summary

An out-of-bounds read vulnerability exists in libpng's png_image_read_composite function when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API, leading to memory corruption.

---

Vulnerability Details

Root Cause

In png_init_read_transformations at line ~1336, the palette expansion code performs:

component += (255-alpha)*png_sRGB_table[outrow[c]];

This calculation produces component values up to 16,776,960 (0x1000800), where (component >> 15) == 512. The subsequent PNG_sRGB_FROM_LINEAR macro in png_image_read_composite performs out-of-bounds array access:

png_sRGB_base[component>>15]    // Accesses png_sRGB_base[512]
png_sRGB_delta[component>>15]   // Accesses png_sRGB_delta[512]
// Both arrays have indices 0-511 only (size 512)

The issue occurs when:

1. PNG uses palette mode (color type 3) with transparency (tRNS chunk)
2. Application uses simplified API with alpha-capable format
3. PNG_FLAG_OPTIMIZE_ALPHA is internally enabled
4. Palette expansion performs premultiplication with background compositing

Vulnerable Component

• File: pngread.c, pngtrans.c
• Functions: png_image_read_composite, png_init_read_transformations
• Code Path: Simplified API → Palette expansion with alpha optimization

Invariant Violation

Expected: component ≤ alpha × 257
         Ensures (component >> 15) ≤ 511 (within array bounds)

Actual:   component = previous_value + (255-alpha) × png_sRGB_table[RGB_value]
         With alpha=0, RGB=255: component can exceed expected bounds
         
Result:   (component >> 15) can equal 512 (out of bounds access)

---

Affected Versions

Vulnerable Versions

• Software: libpng
• Versions: All versions < 1.6.51
• Platforms: Linux, Windows, macOS, BSD, etc.
• Architectures: x86, x64, ARM, ARM64, etc.

Patched Versions

• First Patched Version: 1.6.51
• Release Date: 2025-11-21
• Patch Commit: 08da33b

Version Detection

# Method 1: pkg-config
pkg-config --modversion libpng

# Method 2: Direct library query
libpng-config --version

# Method 3: Check binary
strings /usr/lib/libpng*.so* | grep -i "libpng version"

# Method 4: From source
grep PNG_LIBPNG_VER_STRING png.h

---

Technical Analysis

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious PNG file with specific characteristics:

1. Attack Prerequisites:

   • Target application uses libpng < 1.6.51
   • Application uses simplified PNG API (png_image_* functions)
   • Application requests alpha-capable output format (e.g., RGBA, ARGB)

2. Attack Steps:

   • Create palette PNG (color type 3) with tRNS chunk
   • Set palette entries to maximum RGB values (255, 255, 255)
   • Set alpha values to zero for multiple palette entries
   • Victim application processes the PNG with alpha format
   • PNG_FLAG_OPTIMIZE_ALPHA is enabled internally
   • Palette expansion violates component invariant
   • Out-of-bounds array access occurs

3. Attack Outcome:

   • Out-of-bounds read from png_sRGB_base or png_sRGB_delta
   • Memory corruption leads to heap-use-after-free
   • Application crash (denial of service)
   • Potential information disclosure via OOB read

Memory Layout

┌─────────────────┐
│ png_sRGB_base   │  Array indices: 0-511 (512 entries)
│ [512 entries]   │  Valid access: (component >> 15) ≤ 511
├─────────────────┤
│ [OOB Access]    │  Index 512 ← Vulnerable access when component ≥ 0x1000000
├─────────────────┤
│ png_sRGB_delta  │  Array indices: 0-511 (512 entries)
│ [512 entries]   │  Also vulnerable to same OOB access
├─────────────────┤
│ Adjacent Memory │  Potential information disclosure
└─────────────────┘

Calculation that causes overflow:
component = alpha × component + (255-alpha) × png_sRGB_table[palette_RGB]

When alpha=0 and palette_RGB=255:
component = 0 + 255 × 65535 = 16,711,425
(component >> 15) = 512 (OUT OF BOUNDS!)

Trigger Conditions

Required Conditions:

• PNG color type 3 (indexed/palette)
• tRNS chunk present (transparency)
• Alpha values of 0 in tRNS chunk
• High RGB values in palette (especially 255, 255, 255)
• Simplified API usage (png_image_finish_read)
• Alpha-capable format (PNG_FORMAT_ARGB, PNG_FORMAT_RGBA with flags)

Optional Factors:

• Format with PNG_FORMAT_FLAG_AFIRST increases crash likelihood
• Larger images provide more opportunities to trigger the bug
• Multiple zero-alpha palette entries increase reliability

Non-Triggering Conditions:

• libpng >= 1.6.51 (patched)
• PNG_FORMAT_RGBA without additional flags (sometimes safe)
• Non-palette color types (RGB, grayscale, etc.)
• Palette without transparency
• All alpha values = 255 (fully opaque)

---

Proof of Concept

Quick Start

# Clone repository
git clone https://github.com/truediogo/CVE-2025-64720
cd CVE-2025-64720

# Generate images
python3 generate-images.py

# Build test
chmod +x build.sh
./build.sh

# Run exploit (requires vulnerable libpng < 1.6.51)
./test_asan exploit_v1.png exploit_v2.png exploit_v3.png exploit_v4.png

PoC Components

1. Exploit Generator (generate-images.py)

Generates malicious PNG files that trigger the vulnerability.

Usage:

python3 generate_poc.py

Output:

• exploit_v1.png - 8x8 image, uniform white palette, zero alpha
• exploit_v2.png - 8x8 image, strategic palette variation
• exploit_v3.png - 64x64 image, large with repeated patterns
• exploit_v4.png - 4x4 image, minimal case with all-zero alpha

Options:

# Generate specific variant
generate_malicious_png('custom.png', variant=2)

# Variants:
# 1: Maximum RGB values with zero alpha (reliable)
# 2: Strategic palette designed for maximum overflow
# 3: Larger image with repeated triggering patterns
# 4: Minimal case targeting global-buffer-overflow

2. Test (test.c)

Processes PNG files using the simplified API and demonstrates the vulnerability.

Compilation:

# With AddressSanitizer (recommended - best detection)
gcc -o test_asan test.c -lpng -fsanitize=address -g -O0 -fno-omit-frame-pointer

# With UndefinedBehaviorSanitizer
gcc -o test_ubsan test.c -lpng -fsanitize=undefined -g -O0

# With debugging symbols
gcc -o test_debug test.c -lpng -g -O0

# For Valgrind
gcc -o test_valgrind test.c -lpng -g -O0 -fno-inline

Features:

• Tests multiple alpha-capable formats (RGBA, ARGB, LINEAR_RGB_ALPHA)
• Displays libpng version and vulnerability status
• Shows first pixel values for verification
• Comprehensive error handling

Expected Output

On Vulnerable Version (libpng 1.6.36):

libpng version: 1.6.36
PNG_LIBPNG_VER: 10636

[!] libpng < 1.6.51 detected (vulnerable version)

=== Testing: exploit_v1.png ===
File: exploit_v1.png
Original format: 0xb
Image: 8x8

Trying format: PNG_FORMAT_RGBA (0x3)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00