git: ae6d80d8d9b9 - main - security/vuxml: Add png vulnerability

From: Fernando Apesteguía <fernape_at_FreeBSD.org>
Date: Mon, 16 Feb 2026 16:20:42 UTC 
The branch main has been updated by fernape:

URL: https://cgit.FreeBSD.org/ports/commit/?id=ae6d80d8d9b958f7cfdcf82c6e620437fa50a25c

commit ae6d80d8d9b958f7cfdcf82c6e620437fa50a25c
Author:     Fernando Apesteguía <fernape@FreeBSD.org>
AuthorDate: 2026-02-16 16:18:42 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2026-02-16 16:18:42 +0000

    security/vuxml: Add png vulnerability
    
     * CVE-2026-25646
---
 security/vuxml/vuln/2026.xml | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index e9a9973dfffa..6d62246e0d0d 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,40 @@
+  <vuln vid="f9cb72e4-0b52-11f1-8e75-b42e991fc52e">
+    <topic>png -- CWE-122: Heap-based Buffer Overflow</topic>
+    <affects>
+    <package>
+	<name>png</name>
+	<range><lt>1.6.55</lt></range>
+    </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3 reports:</p>
+	<blockquote cite="https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3">
+	  <p>LIBPNG is a reference library for use in applications
+	  that read, create, and manipulate PNG (Portable Network
+	  Graphics) raster image files.  Prior to 1.6.55, an
+	  out-of-bounds read vulnerability exists in the
+	  png_set_quantize() API function.  When the function is
+	  called with no histogram and the number of colors in the
+	  palette is more than twice the maximum supported by the
+	  user's display, certain palettes will cause the function to
+	  enter into an infinite loop that reads past the end of an
+	  internal heap-allocated buffer.  The images that trigger
+	  this vulnerability are valid per the PNG specification.
+	  This vulnerability is fixed in 1.6.55.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2026-25646</cvename>
+      <url>https://cveawg.mitre.org/api/cve/CVE-2026-25646</url>
+    </references>
+    <dates>
+      <discovery>2026-02-10</discovery>
+      <entry>2026-02-16</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="590979aa-09f7-11f1-a730-5404a68ad561">
     <topic>traefik -- TCP readTimeout bypass via STARTTLS on Postgres</topic>
     <affects>