Out-of-Bounds Read in libpng png_image_read_composite

This repository provides a working proof-of-concept (PoC) exploit for CVE-2025-64720, a high-severity out-of-bounds read vulnerability in libpng (< 1.6.51) affecting the palette premultiplication code path. The exploit is implemented as a set of Python scripts (notably generate-images.py) that generate specially crafted PNG files (exploit_v1.png, exploit_v2.png, etc.) designed to trigger the vulnerability when processed by a vulnerable libpng build. The repository includes a full copy of libpng-1.6.36 source code, build scripts (build.sh) for compiling libpng with various sanitizers, and example/test programs. The exploit targets applications using the simplified PNG API with alpha-capable output formats and demonstrates how a malicious PNG can cause a crash or information disclosure via OOB reads. No network endpoints are involved; the attack vector is file-based. The repository is well-structured for research, testing, and patch validation, and includes detailed documentation and legal disclaimers.

This repository is a comprehensive proof-of-concept (PoC) for CVE-2025-64720, a high-severity out-of-bounds read vulnerability in libpng (<1.6.51) when processing palette PNG images with transparency and alpha optimization. The exploit is not part of a framework but is a standalone PoC. The repository includes: - A detailed README.md with technical analysis, exploitation prerequisites, and references to upstream patches and bug reports. - A Python script (`generate-images.py`) that generates multiple variants of malicious PNG files designed to trigger the vulnerability by manipulating palette and tRNS chunks. - Build scripts and a full copy of the vulnerable libpng-1.6.36 source, including test and example programs. - The exploit works by supplying a crafted PNG file to a target application using the vulnerable libpng version and the simplified PNG API. When the file is processed, it causes an out-of-bounds read in the `png_sRGB_base` or `png_sRGB_delta` arrays, potentially leading to a heap-use-after-free, application crash, or information disclosure. No network endpoints or remote services are involved; the attack vector is a malicious file. The PoC is operational and can be used to verify the vulnerability or test defenses. The repository is well-structured, with clear separation between the PoC generator, build/test scripts, and the included libpng source.

This repository is a comprehensive proof-of-concept (PoC) for CVE-2025-64720, a high-severity out-of-bounds read vulnerability in libpng (<1.6.51) affecting palette image processing with transparency and alpha optimization. The repository contains: - A detailed README.md with technical analysis, exploitation prerequisites, and version detection methods. - A Python script (generate-images.py) that generates multiple variants of malicious PNG files designed to trigger the vulnerability by manipulating palette and alpha values. - A build.sh script to compile and test libpng with various sanitizers (ASan, UBSan, Valgrind) for vulnerability validation. - The full libpng-1.6.36 source code, including test and example programs, for building and testing the exploit in a controlled environment. The exploit works by generating PNG files that, when processed by a vulnerable libpng version in an application using the simplified API and requesting an alpha-capable output, cause an out-of-bounds read in the `png_sRGB_base` or `png_sRGB_delta` arrays. This can result in application crashes or information disclosure. The attack vector is file-based, requiring the victim to open a crafted PNG image. No network or remote endpoints are involved. The repository is well-structured for research, testing, and validation of the vulnerability, and does not contain fake or destructive code.