libpng updates to fix a 1995 flaw: 17 decades-old bugs still linger

Libpng, the PNG image library sitting under a huge amount of software, got an update in February 2026 to fix CVE-2026-25646. This one goes all the way back to 1995. It was rated high severity, and it was also one of 17 vulnerabilities that stayed buried for more than a decade.

The flaw is a heap buffer overflow in the rarely used `png_set_quantize` function. A maliciously crafted PNG could crash an app and, in the worst case, expose information or open the door to remote code execution. Vulnerable libpng builds showed up in Debian, Red Hat, Ubuntu, desktop applications, and some Java runtimes. It’s a good example of how code written in the early Unix and DOS years still ends up inside current systems, even when actually exploiting the bug may not be easy.

PrintDemon follows the same script. It was a Windows printer weakness introduced in 1996 and not fixed until May 2020. What started as a permissive design choice to make printer setup easier turned into a security problem years later.

If you’re responsible for Linux, Windows, operational technology, or critical infrastructure, both the libpng fixes and the Windows patches are worth installing. Organizations still take more than 100 days on average to patch. Nearly 60% of compromises involve unpatched vulnerabilities. And older unsupported systems often don’t have strong access controls or modern encryption in place.

Get the patched versions from your Linux distribution, the affected application or Java runtime update, and Windows Update.