libpng 1.6.52 (the second-most critical update in decades) released!

--===============2795346010756023897==
Content-Type: multipart/alternative; boundary="0000000000002bcc3d064512d7ac"

--0000000000002bcc3d064512d7ac
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Dear community of PNG and libpng users,

Hot on the heels of 1.6.51, here comes libpng-1.6.52 with one more
high-severity fix. This one is... unusual.

CVE-2025-66293 is an out-of-bounds read in `png_image_read_composite` that
can be triggered by ***completely valid, spec-compliant PNG files***. No
malicious crafting required. Any palette image with partial transparency
(tRNS with alpha values 1=E2=80=93254) and gamma correction (gAMA chunk), w=
hen
processed through the simplified API requesting output without alpha and no
explicit background, will trigger the bug. The root cause is an internal
flag synchronization issue between PNG_COMPOSE and PNG_FLAG_OPTIMIZE_ALPHA.

If you use the simplified libpng API (png_image_* functions) to process
palette images, you need this update. To the best of my knowledge, web
browsers use the low-level API and are not affected.

The gory details are available at:
- https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4=
f
- https://github.com/pnggroup/libpng/blob/v1.6.52/ANNOUNCE

Many thanks to @flyfish101 for reporting this issue.

On the non-security front: Liang Junzhao fixed the Paeth filter handling in
the RISC-V RVV implementation (reported by Filip Wasil) and improved its
performance. Philippe Antoine contributed allocation failure fuzzing to
oss-fuzz.

In the good old tradition of file authentication, here are the SHA-2-256
checksums of the published archive files:

---

libpng-1.6.52.tar.gz
86d4a88be1c8bc903674199f1d067a9ac940af4e4399caba0314e7a1bcaa0724

libpng-1.6.52.tar.xz
36bd726228ec93a3b6c22fdb49e94a67b16f2fe9b39b78b7cb65772966661ccc

lpng1652.7z
346b71932d80b99b6751c46b6925c0325f0144ee92b18371300d0e684db942e0

lpng1652.zip
63d8366fe994ab1ca17738e2a565288a336751b84ce2c6326f70057d8c9f2bab

---

Sincerely,
Cosmin

--0000000000002bcc3d064512d7ac
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Dear community of PNG and libpng users,<br><br>Hot on the =
heels of 1.6.51, here comes libpng-1.6.52 with one more high-severity fix. =
This one is... unusual.<br><br>CVE-2025-66293 is an out-of-bounds read in `=
png_image_read_composite` that can be triggered by <b>**completely valid, s=
pec-compliant PNG files**</b>. No malicious crafting required. Any palette =
image with partial transparency (tRNS with alpha values 1=E2=80=93254) and =
gamma correction (gAMA chunk), when processed through the simplified API re=
questing output without alpha and no explicit background, will trigger the =
bug. The root cause is an internal flag synchronization issue between <span=
 style=3D"font-family:monospace">PNG_COMPOSE</span> and <span style=3D"font=
-family:monospace">PNG_FLAG_OPTIMIZE_ALPHA</span>.<br><br>If you use the si=
mplified libpng API (<span style=3D"font-family:monospace">png_image_*</spa=
n> functions) to process palette images, you need this update. To the best =
of my knowledge, web browsers use the low-level API and are not affected.<b=
r><br>The gory details are available at:<br>- <a href=3D"https://github.com=
/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f">https://github.co=
m/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f</a><br>- <a href=
=3D"https://github.com/pnggroup/libpng/blob/v1.6.52/ANNOUNCE">https://githu=
b.com/pnggroup/libpng/blob/v1.6.52/ANNOUNCE</a><br><br>Many thanks to @flyf=
ish101 for reporting this issue.<br><br>On the non-security front: Liang Ju=
nzhao fixed the Paeth filter handling in the RISC-V RVV implementation (rep=
orted by Filip Wasil) and improved its performance. Philippe Antoine contri=
buted allocation failure fuzzing to oss-fuzz.<br><br>In the good old tradit=
ion of file authentication, here are the SHA-2-256 checksums of the publish=
ed archive files:<br><br>---<br><br>libpng-1.6.52.tar.gz<br>86d4a88be1c8bc9=
03674199f1d067a9ac940af4e4399caba0314e7a1bcaa0724<br><br>libpng-1.6.52.tar.=
xz<br>36bd726228ec93a3b6c22fdb49e94a67b16f2fe9b39b78b7cb65772966661ccc<br><=
br>lpng1652.7z<br>346b71932d80b99b6751c46b6925c0325f0144ee92b18371300d0e684=
db942e0<br><br>lpng1652.zip<br>63d8366fe994ab1ca17738e2a565288a336751b84ce2=
c6326f70057d8c9f2bab<br><br>---<br><br>Sincerely,<br>Cosmin<br></div>

--0000000000002bcc3d064512d7ac--


--===============2795346010756023897==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============2795346010756023897==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
png-mng-announce mailing list
png-mng-announce-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/png-mng-announce

--===============2795346010756023897==--