Suggested advisory:
========================

The updated packages fix a security vulnerability:

Heap buffer overflow in png_set_quantize when called with no histogram and a palette larger than twice the requested maximum number of colors. (CVE-2026-25646)

References:
https://www.openwall.com/lists/oss-security/2026/02/09/7
========================

Updated packages in core/updates_testing:
========================
lib(64)png16_16-1.6.38-1.4.mga9
lib(64)png-devel-1.6.38-1.4.mga9

from SRPM:
libpng-1.6.38-1.4.mga9.src.rpm

Source RPM: libpng-1.6.53-2.mga10.src.rpm, libpng-1.6.38-1.3.mga9.src.rpm => libpng-1.6.38-1.3.mga9.src.rpm
Flags: affects_mga9+ => (none)
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9
Status: NEW => ASSIGNED

Thank you Nicolas for doing this so quickly.

Assignee: bugsquad => qa-bugs

Installed and tested without issues.

Tested using gimp.
Confirmed that gimp loaded the lib64png16_16 library using strace.
Loaded several png files, and saved them to png files, with various random settings.
Check the saved images using gwenview.
No issues found.



System: Mageia 9, x86_64, Plasma DE, AMD Ryzen 5 5600G with Radeon Graphics using amdgpu driver.



$ uname -a
Linux jupiter 6.6.120-desktop-1.mga9 #1 SMP PREEMPT_DYNAMIC Wed Jan 14 01:59:53 UTC 2026 x86_64 GNU/Linux
$ rpm -qa | grep -P 'lib.*png16_16'
lib64png16_16-1.6.38-1.4.mga9
libpng16_16-1.6.38-1.4.mga9
$ strace -o ~/tmp/gimp.strace gimp
<SNIP>
$ grep -P openat.*libpng gimp.strace
openat(AT_FDCWD, "/usr/lib64/libpng16.so.16", O_RDONLY|O_CLOEXEC) = 3
$ rpm -qf /usr/lib64/libpng16.so.16
lib64png16_16-1.6.38-1.4.mga9

CC: (none) => mageia

No installation issues. Used ImageMagick for testing. Converted several .jpgs to png, and other pngs to gif. Displayed all in Gwenview with no issues.

This looks OK. Validating.

Whiteboard: (none) => MGA9-64-OK
Keywords: (none) => validated_update
Flags: (none) => test_passed_mga9_64+
CC: (none) => andrewsfarm, sysadmin-bugs

MGA9-64 server Plasma Wayland on Compaq H000SB.
No installation issues.
Opened png file OK in inkscape under strace, shows use of the lib.
In view of tests above, good to go.

CC: (none) => herman.viaene

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0038.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED