[Bug report] Security: outdated libpng (1.6.38) and libtiff (≤4.7.0) bundled in MLKitTextRecognitionCommon (iOS) — CVE-2025-64720, CVE-2025-65018, CVE-2025-9900

[abader01]

Summary

The iOS MLKitTextRecognitionCommon.framework statically bundles outdated copies of
libpng and libtiff that are affected by recently disclosed CVEs. Because these libraries
are compiled into Google's pre-built binary, downstream SDKs and apps cannot patch them
and are flagged by enterprise security scanners.

Affected SDK

• Pod: GoogleMLKit/TextRecognition (verified across versions 6.0.0 through 9.0.0)
• Framework: MLKitTextRecognitionCommon.framework
• Platform: iOS

Bundled library versions (verified via strings on the published pod binary)

Library	Version in framework	Affected CVEs	Fixed upstream in
libpng	1.6.38 (Sep 14, 2022)	CVE-2025-64720, CVE-2025-65018	libpng 1.6.51 (Nov 22, 2025)
libtiff	4.6.0–4.7.0 (varies by Common version)	CVE-2025-9900	libtiff 4.7.1
libjpeg-turbo	2.1.5.1	(informational, not flagged)	—

How to reproduce

# After `pod install` of GoogleMLKit/TextRecognition:
BIN=Pods/MLKitTextRecognitionCommon/Frameworks/MLKitTextRecognitionCommon.framework/MLKitTextRecognitionCommon
strings "$BIN" | grep -iE "libpng version|LIBTIFF, Version"
# Output includes:
#   libpng version 1.6.38
#   LIBTIFF, Version 4.6.0   (or 4.7.0 on newer Common releases)

[abader01]

Update: two additional libtiff CVEs now apply to the bundled copy

Since filing this issue, two more CVEs have been disclosed that affect the
libtiff 4.7.0 statically bundled in MLKitTextRecognitionCommon.framework (iOS),
verified present in the current latest release (GoogleMLKit 9.0.0 /
MLKitTextRecognitionCommon 6.0.0):

CVE	Component	Impact	Severity	Fixed upstream
CVE-2026-4775	putcontig8bitYCbCr44tile and related functions in tif_getimage.c	Signed integer overflow → out-of-bounds heap write → DoS / potential code execution	High (CVSS 7.8, AV:L/UI:R)	Distro patches Apr–Jun 2026 (e.g. RHSA series from RHBZ#2450768)
CVE-2026-36849	Tag handling — oversized SamplesPerPixel	Denial of service	Medium	Patched by distros (e.g. Debian tiff 4.7.1-3); not yet in any upstream libtiff release tag

Both vulnerable code paths are compiled into the shipped binary — strings on
MLKitTextRecognitionCommon shows the TIFFReadRGBAStrip / TIFFReadRGBATile /
YCbCr subsampling handlers (tif_getimage.c) and SamplesPerPixel tag processing.

This brings the total to five CVEs in the bundled image libraries:

• libpng 1.6.38: CVE-2025-64720, CVE-2025-65018 (fixed in libpng 1.6.51)
• libtiff 4.7.0: CVE-2025-9900 (fixed in 4.7.1), CVE-2026-4775, CVE-2026-36849
  (require current patched libtiff)

Note that libtiff 4.7.1 alone is no longer sufficient — CVE-2026-36849 requires
patches beyond the last tagged upstream release, so please rebase the bundled
libtiff on the current upstream master or apply the distro patch set.

References:

• https://bugzilla.redhat.com/show_bug.cgi?id=2450768 (CVE-2026-4775)
• https://git.almalinux.org/rpms/libtiff/commit/9c9f2f8ce916ae50aa24f59a259ec28ada743c4a
• https://launchpad.net/debian/+source/tiff/+changelog (CVE-2026-36849, 4.7.1-3)