CVE-2025-66293
high
CVSS v3
—
CVSS v4 NEW
—
VIR risk
8.0
Description
RHSA-2026:9686: java-17-openjdk security update (Important)
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API
Description libpng: LIBPNG out-of-bounds read in png_image_read_composite Red Hat statement The Red Hat Product Security team has rated this vulnerability as Important as it affects libpng, a widely used library for PNG image processing. The flaw is due to an out-of-bounds read in libpng’s simplified API when handling specially crafted PNG images containing partial transparency and gamma…
Description
libpng: LIBPNG out-of-bounds read in png_image_read_composite
Red Hat statement
The Red Hat Product Security team has rated this vulnerability as Important as it affects libpng, a widely used library for PNG image processing. The flaw is due to an out-of-bounds read in libpng’s simplified API when handling specially crafted PNG images containing partial transparency and gamma correction data. Successful exploitation could result in information disclosure or cause application crashes in applications processing untrusted PNG content. For `java-17-openjdk-headless` and `java-21-openjdk-headless`, while the affected code is present in the bundled sources, it is not exercised by these headless packages.
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| OPENJDK ELS 11.0.31 | java-11-openjdk-portable | RHSA-2026:9255 | 2026-04-22T00:00:00Z |
| Red Hat Enterprise Linux 10 | libpng-2:1.6.40-8.el10_1.1 | RHSA-2026:0237 | 2026-01-07T00:00:00Z |
| Red Hat Enterprise Linux 10.0 Extended Update Support | libpng-2:1.6.40-8.el10_0.1 | RHSA-2026:0212 | 2026-01-07T00:00:00Z |
| Red Hat Enterprise Linux 8 | mingw-libpng-0:1.6.34-1.el8_10 | RHSA-2026:0125 | 2026-01-06T00:00:00Z |
| Red Hat Enterprise Linux 8 | libpng-2:1.6.34-9.el8_10 | RHSA-2026:0241 | 2026-01-07T00:00:00Z |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | libpng-2:1.6.34-8.el8_2.1 | RHSA-2026:0323 | 2026-01-08T00:00:00Z |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | libpng-2:1.6.34-8.el8_4.1 | RHSA-2026:0321 | 2026-01-08T00:00:00Z |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | libpng-2:1.6.34-8.el8_4.1 | RHSA-2026:0321 | 2026-01-08T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | libpng-2:1.6.34-8.el8_6.1 | RHSA-2026:0322 | 2026-01-08T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | libpng-2:1.6.34-8.el8_6.1 | RHSA-2026:0322 | 2026-01-08T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | libpng-2:1.6.34-8.el8_6.1 | RHSA-2026:0322 | 2026-01-08T00:00:00Z |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | libpng-2:1.6.34-8.el8_8.1 | RHSA-2026:0313 | 2026-01-08T00:00:00Z |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | libpng-2:1.6.34-8.el8_8.1 | RHSA-2026:0313 | 2026-01-08T00:00:00Z |
| Red Hat Enterprise Linux 9 | libpng-2:1.6.37-12.el9_7.1 | RHSA-2026:0238 | 2026-01-07T00:00:00Z |
| Red Hat Enterprise Linux 9 | libpng-2:1.6.37-12.el9_7.1 | RHSA-2026:0238 | 2026-01-07T00:00:00Z |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | libpng-2:1.6.37-12.el9_0.1 | RHSA-2026:0234 | 2026-01-07T00:00:00Z |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | libpng-2:1.6.37-12.el9_2.1 | RHSA-2026:0216 | 2026-01-07T00:00:00Z |
| Red Hat Enterprise Linux 9.4 Extended Update Support | libpng-2:1.6.37-12.el9_4.1 | RHSA-2026:0211 | 2026-01-07T00:00:00Z |
| Red Hat Enterprise Linux 9.6 Extended Update Support | libpng-2:1.6.37-12.el9_6.1 | RHSA-2026:0210 | 2026-01-07T00:00:00Z |
| Red Hat OpenJDK 11 els for RHEL 7 | java-11-openjdk-1:11.0.31.0.11-1.el7_9 | RHSA-2026:9254 | 2026-04-22T00:00:00Z |
| Red Hat OpenJDK 11 els for RHEL 8 | java-11-openjdk-1:11.0.31.0.11-1.el8 | RHSA-2026:9254 | 2026-04-22T00:00:00Z |
| Red Hat OpenJDK 11 els for RHEL 9 | java-11-openjdk-1:11.0.31.0.11-1.el9 | RHSA-2026:9254 | 2026-04-22T00:00:00Z |
| Red Hat OpenShift Container Platform 4.12 | rhcos-412.86.202603041314-0 | RHSA-2026:3861 | 2026-03-12T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | rhcos-413.92.202602240113-0 | RHSA-2026:3415 | 2026-03-05T00:00:00Z |
| Red Hat OpenShift Container Platform 4.14 | rhcos-414.92.202602171627-0 | RHSA-2026:2974 | 2026-02-26T00:00:00Z |
| Red Hat OpenShift Container Platform 4.15 | rhcos-415.92.202603101737-0 | RHSA-2026:4419 | 2026-03-19T00:00:00Z |
| Red Hat OpenShift Container Platform 4.16 | rhcos-416.94.202602101357-0 | RHSA-2026:2659 | 2026-02-18T00:00:00Z |
| Red Hat OpenShift Container Platform 4.17 | rhcos-417.94.202602090846-0 | RHSA-2026:2671 | 2026-02-18T00:00:00Z |
| Red Hat OpenShift Container Platform 4.18 | rhcos-418.94.202602022246-0 | RHSA-2026:2072 | 2026-02-11T00:00:00Z |
| Red Hat OpenShift Container Platform 4.19 | rhcos-4.19.9.6.202602112047-0 | RHSA-2026:2633 | 2026-02-18T00:00:00Z |
| Red Hat Discovery 2 | discovery/discovery-ui-rhel9:1767904573 | RHSA-2026:0414 | 2026-01-08T00:00:00Z |
| Red Hat Hardened Images | libpng-main-1.6.56-1.hum1 | RHSA-2026:6732 | 2026-04-07T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat build of OpenJDK 11 ELS | java-21-openjdk-portable | Not affected |
| Red Hat build of OpenJDK 17 | java-17-openjdk-portable | Affected |
| Red Hat build of OpenJDK 17 | java-21-openjdk-portable | Not affected |
| Red Hat build of OpenJDK 1.8 | java-1.8.0-openjdk-portable | Affected |
| Red Hat build of OpenJDK 21 | java-21-openjdk-portable | Affected |
| Red Hat build of OpenJDK 21 | java-21-openjdk-portable-rhel7 | Not affected |
| Red Hat build of OpenJDK 25 | java-21-openjdk-vanilla | Not affected |
| Red Hat build of OpenJDK 25 | java-25-openjdk-portable | Affected |
| Red Hat Enterprise Linux 10 | firefox | Not affected |
| Red Hat Enterprise Linux 10 | java-21-openjdk | Affected |
| Red Hat Enterprise Linux 10 | java-25-openjdk | Affected |
| Red Hat Enterprise Linux 10 | thunderbird | Not affected |
| Red Hat Enterprise Linux 6 | libpng | Will not fix |
| Red Hat Enterprise Linux 7 | firefox | Not affected |
| Red Hat Enterprise Linux 7 | java-11-openjdk | Not affected |
| Red Hat Enterprise Linux 7 | libpng | Not affected |
| Red Hat Enterprise Linux 7 | libpng12 | Not affected |
| Red Hat Enterprise Linux 8 | firefox | Not affected |
| Red Hat Enterprise Linux 8 | java-17-openjdk | Affected |
| Red Hat Enterprise Linux 8 | java-1.8.0-openjdk | Affected |
| Red Hat Enterprise Linux 8 | java-21-openjdk | Affected |
| Red Hat Enterprise Linux 8 | libpng12 | Not affected |
| Red Hat Enterprise Linux 8 | libpng15 | Not affected |
| Red Hat Enterprise Linux 8 | thunderbird | Not affected |
| Red Hat Enterprise Linux 9 | firefox | Not affected |
| Red Hat Enterprise Linux 9 | java-17-openjdk | Affected |
| Red Hat Enterprise Linux 9 | java-1.8.0-openjdk | Affected |
| Red Hat Enterprise Linux 9 | java-21-openjdk | Affected |
| Red Hat Enterprise Linux 9 | libpng15 | Not affected |
| Red Hat Enterprise Linux 9 | thunderbird | Not affected |
Apply commands
Apply RHSA-2026:9255 for OPENJDK ELS 11.0.31
yum update -y java
# or:
dnf upgrade -y javaAffected
| Vendor | Product | Version |
|---|---|---|
| redhat | Red Hat build of OpenJDK 11 ELS | Not affected |
| redhat | Red Hat build of OpenJDK 17 | Affected |
| redhat | Red Hat build of OpenJDK 17 | Not affected |
| redhat | Red Hat build of OpenJDK 1.8 | Affected |
| redhat | Red Hat build of OpenJDK 21 | Affected |
| redhat | Red Hat build of OpenJDK 21 | Not affected |
| redhat | Red Hat build of OpenJDK 25 | Not affected |
| redhat | Red Hat build of OpenJDK 25 | Affected |
| redhat | Red Hat Enterprise Linux 10 | Not affected |
| redhat | Red Hat Enterprise Linux 10 | Affected |
| redhat | Red Hat Enterprise Linux 10 | Affected |
| redhat | Red Hat Enterprise Linux 10 | Not affected |
| redhat | Red Hat Enterprise Linux 7 | Not affected |
| redhat | Red Hat Enterprise Linux 7 | Not affected |
| redhat | Red Hat Enterprise Linux 7 | Not affected |
| redhat | Red Hat Enterprise Linux 7 | Not affected |
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 8 | Affected |
| redhat | Red Hat Enterprise Linux 8 | Affected |
| redhat | Red Hat Enterprise Linux 8 | Affected |
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 9 | Not affected |
| redhat | Red Hat Enterprise Linux 9 | Affected |
| redhat | Red Hat Enterprise Linux 9 | Affected |
| redhat | Red Hat Enterprise Linux 9 | Affected |
| redhat | Red Hat Enterprise Linux 9 | Not affected |
| redhat | Red Hat Enterprise Linux 9 | Not affected |
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rocky | 8 | fixed | |
| rhel | 9 | fixed | |
| debian | bookworm | fixed | 1.6.39-2+deb12u1 |
| debian | bullseye | fixed | 1.6.37-3+deb11u1 |
| debian | forky | fixed | 1.6.52-1 |
| debian | sid | fixed | 1.6.52-1 |
| debian | trixie | fixed | 1.6.48-1+deb13u1 |
| sles | affected | | |
| rocky | 9 | fixed | |
References
- https://errata.rockylinux.org/RLSA-2026:0241
- https://errata.rockylinux.org/RLSA-2026:0125
- https://access.redhat.com/errata/RHSA-2026:0238
- https://security-tracker.debian.org/tracker/CVE-2025-66293
- https://www.suse.com/security/cve/CVE-2025-66293.html
- https://errata.rockylinux.org/RLSA-2026:0238
- https://access.redhat.com/errata/RHSA-2026:0125
- https://bugzilla.redhat.com/2416904
- https://bugzilla.redhat.com/2416907
- https://bugzilla.redhat.com/2418711
- https://errata.almalinux.org/8/ALSA-2026-0125.html
- https://access.redhat.com/errata/RHSA-2026:0241
- https://errata.almalinux.org/8/ALSA-2026-0241.html
- https://errata.almalinux.org/9/ALSA-2026-0238.html
- https://access.redhat.com/errata/RHSA-2026:9686
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.