CVE-2026-22801 LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_*