CVE-2025-65018

HIGH

libpng 1.6.0-1.6.50 - Heap-based Buffer Overflow in png_image_finish_read

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-65018. PoCs published by Neo-Neo6, bohemian-miser.

AI-analyzed exploit summary This PoC exploits a heap buffer overflow in libpng on PS4/PS5 by modifying a PNG's IHDR chunk to force 16-bit RGB with Adam7 interlacing, causing a crash (CE-34196-3) when opened in the Gallery app. The script manipulates PNG metadata to trigger the vulnerability.

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.

Exploits (2)

nomisec WORKING POC 9 stars
by Neo-Neo6 · poc
https://github.com/Neo-Neo6/CVE-2025-65018-Heap-buffer-overflow-in-libpng-ps4-ps5-

This PoC exploits a heap buffer overflow in libpng on PS4/PS5 by modifying a PNG's IHDR chunk to force 16-bit RGB with Adam7 interlacing, causing a crash (CE-34196-3) when opened in the Gallery app. The script manipulates PNG metadata to trigger the vulnerability.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: libpng on PlayStation 4/5 Gallery app
No auth needed
Prerequisites: A valid PNG file from the target PS4/PS5 · FTP access to the device to replace the screenshot
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by bohemian-miser · poc
https://github.com/bohemian-miser/CVE-2025-65018_Exploit_Challenge

This repository contains a working exploit PoC for CVE-2025-65018, a heap overflow vulnerability in libpng's handling of 16-bit interlaced PNG images. The exploit crafts a malicious PNG file to overwrite a function pointer and redirect execution to a shell-spawning function.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: libpng v1.6.37
No auth needed
Prerequisites: gcc · make · python3 · git · autoconf · automake · libtool
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.1
EPSS 0.0019
EPSS Percentile 9.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-122 CWE-787
Status published
Products (1)
libpng/libpng 1.6.0 - 1.6.51
Published Nov 25, 2025
Tracked Since Feb 18, 2026